PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-52034 mySCADA CVE debrief

A critical OS command injection vulnerability in mySCADA myPRO Manager allows unauthenticated remote attackers to execute arbitrary operating system commands. The vulnerability, published by CISA on November 21, 2024, carries a CVSS 3.1 score of 10.0 (Critical) with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The scope is changed, with high impact on confidentiality, integrity, and availability. Affected products include myPRO Manager versions prior to 1.3 and myPRO Runtime versions prior to 9.2.1. The vulnerability exists due to improper neutralization of special elements in a command parameter, enabling command injection without authentication.

Vendor
mySCADA
Product
myPRO Manager
CVSS
CRITICAL 10
CISA KEV
Not listed in stored evidence
Original CVE published
2024-11-21
Original CVE updated
2024-11-21
Advisory published
2024-11-21
Advisory updated
2024-11-21

Who should care

Organizations operating mySCADA myPRO Manager or myPRO Runtime in industrial control system (ICS) environments, particularly those with internet-exposed or poorly segmented OT networks. Critical infrastructure operators, manufacturing facilities, and utilities relying on mySCADA products for process control and monitoring should prioritize immediate patching and network access restrictions.

Technical summary

CVE-2024-52034 is an OS command injection vulnerability in mySCADA myPRO Manager and myPRO Runtime. An unauthenticated remote attacker can inject arbitrary operating system commands through a parameter within a command. The vulnerability is rated Critical (CVSS 3.1: 10.0) due to network accessibility, low complexity, no authentication requirements, and high impacts across confidentiality, integrity, and availability with scope change. Affected versions: myPRO Manager prior to 1.3, myPRO Runtime prior to 9.2.1. Remediation requires updating to myPRO Manager 1.3 and myPRO Runtime 9.2.1.

Defensive priority

CRITICAL

Recommended defensive actions

  • Immediately update myPRO Manager to version 1.3 or later and myPRO Runtime to version 9.2.1 or later per vendor guidance.
  • Restrict network access to myPRO Manager and myPRO Runtime systems to authorized administrative hosts only; deploy firewall rules to block internet-facing exposure.
  • Monitor for anomalous command execution, unexpected child processes, or unauthorized network connections originating from myPRO systems.
  • Review system logs for indicators of compromise, particularly around the time of the advisory publication (November 21, 2024) and thereafter.
  • Apply network segmentation to isolate OT/ICS environments hosting myPRO products from enterprise IT networks and the internet.
  • Disable or remove unnecessary services and features in myPRO deployments to reduce attack surface.

Evidence notes

CISA ICS Advisory ICSA-24-326-07 confirms unauthenticated remote OS command injection via a parameter within a command. CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Affected products: myPRO Manager <1.3, myPRO Runtime <9.2.1.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-52034 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-52034

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-52034 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-52034

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-326-07.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-07

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.