PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-20061 mySCADA CVE debrief

A critical command injection vulnerability in mySCADA myPRO Manager and myPRO Runtime allows unauthenticated remote attackers to execute arbitrary commands on affected systems. The flaw stems from improper neutralization of POST requests containing email information sent to a specific port. With a CVSS 3.1 score of 9.8, this vulnerability presents severe risk to industrial control environments due to its network-exploitable nature, low attack complexity, and no required privileges or user interaction. The affected products are myPRO Manager versions prior to 1.3 and myPRO Runtime versions prior to 9.2.1. CISA published advisory ICSA-25-023-01 on January 23, 2025, coordinating disclosure with the vendor. No known exploitation in ransomware campaigns has been reported, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. Organizations should prioritize patching to myPRO Manager 1.3 or myPRO Runtime 9.2.1 and implement network segmentation to limit exposure of ICS assets.

Vendor
mySCADA
Product
myPRO Manager
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-01-23
Original CVE updated
2025-01-23
Advisory published
2025-01-23
Advisory updated
2025-01-23

Who should care

Industrial control system operators, critical infrastructure security teams, SCADA engineers, OT security architects, and organizations using mySCADA myPRO products for process control and monitoring

Technical summary

The vulnerability exists due to improper input validation when processing POST requests containing email information on a specific port. An attacker can craft malicious requests to inject and execute arbitrary operating system commands with the privileges of the myPRO service. The attack requires no authentication and can be executed remotely over the network. Affected versions include myPRO Manager prior to 1.3 and myPRO Runtime prior to 9.2.1. The vendor has released patched versions that properly neutralize malicious input.

Defensive priority

critical

Recommended defensive actions

  • Update mySCADA myPRO Manager to version 1.3 or later
  • Update mySCADA myPRO Runtime to version 9.2.1 or later
  • Restrict network access to myPRO management interfaces to authorized administrative hosts only
  • Implement network segmentation to isolate ICS/SCADA systems from untrusted networks
  • Monitor for anomalous POST requests to myPRO services containing email-related parameters
  • Apply defense-in-depth strategies per CISA ICS recommended practices

Evidence notes

Vulnerability description and affected product versions derived from CISA CSAF source. CVSS vector confirms network attack vector with no privileges required. Remediation guidance specifies exact patched versions.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-20061 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-20061

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-20061 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-20061

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-023-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-023-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.