PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-20014 mySCADA CVE debrief

A critical command injection vulnerability in mySCADA myPRO Manager and myPRO Runtime allows unauthenticated remote attackers to execute arbitrary commands via crafted POST requests to a specific port. The vulnerability stems from improper neutralization of version information in POST requests, enabling network-based exploitation without authentication. Affected versions include myPRO Manager prior to 1.3 and myPRO Runtime prior to 9.2.1. The vendor has released patched versions that address this vulnerability. Organizations using affected versions should prioritize patching due to the critical severity and unauthenticated remote attack vector.

Vendor
mySCADA
Product
myPRO Manager
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-01-23
Original CVE updated
2025-01-23
Advisory published
2025-01-23
Advisory updated
2025-01-23

Who should care

Organizations operating mySCADA myPRO Manager or myPRO Runtime in industrial control system (ICS) environments, including manufacturing, energy, water/wastewater, and critical infrastructure sectors. Security teams responsible for OT/ICS asset protection, SCADA system administrators, and network defenders monitoring industrial networks should prioritize assessment and remediation.

Technical summary

The vulnerability exists in mySCADA myPRO products due to improper input validation when processing POST requests containing version information sent to a specific port. An attacker can craft malicious POST requests that inject arbitrary commands, which are then executed on the affected system with the privileges of the myPRO service. The attack requires network access to the target port but no authentication, making it exploitable by any network-adjacent or internet-facing instance. The CVSS 3.1 score of 9.8 reflects the unauthenticated nature, low attack complexity, and high impact across all security dimensions. Both the management interface (myPRO Manager) and runtime component (myPRO Runtime) are affected, with patches available in versions 1.3 and 9.2.1 respectively.

Defensive priority

critical

Recommended defensive actions

  • Update mySCADA myPRO Manager to version 1.3 or later
  • Update mySCADA myPRO Runtime to version 9.2.1 or later
  • Restrict network access to myPRO management interfaces to authorized administrative hosts only
  • Monitor for unexpected POST requests to myPRO service ports containing version information
  • Review system logs for indicators of unauthorized command execution
  • Apply defense-in-depth controls per CISA ICS recommended practices for industrial control systems

Evidence notes

Vulnerability description and affected product versions derived from CISA CSAF advisory ICSA-25-023-01. CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms network-based, unauthenticated exploitation with high impact across confidentiality, integrity, and availability. Vendor remediation guidance specifies myPRO Manager 1.3 and myPRO Runtime 9.2.1 as fixed versions.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-20014 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-20014

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-20014 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-20014

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-023-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-023-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.