CVE-2025-22896 mySCADA CVE debrief

Who should care

Organizations using mySCADA myPRO Manager, especially industrial control systems and OT teams that rely on this software, should review their deployments immediately. Security teams responsible for credential protection, system hardening, and vendor patch management should treat this as a priority because exposed credentials can undermine broader access controls.

Technical summary

The CSAF advisory states that mySCADA myPRO Manager stores credentials in cleartext. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, yielding a high-severity score of 8.6. The primary impact is confidentiality loss: credentials can be disclosed if an attacker can access the affected storage or system context. CISA identifies mySCADA myPRO Manager versions before 1.4 as affected and directs users to upgrade to v1.4.

Defensive priority

High. Cleartext credential storage is a direct secrets-exposure weakness and can enable follow-on compromise if those credentials are reused elsewhere. Because the issue is published by CISA and affects an OT-related product, remediation should be prioritized even though no KEV listing is provided.

Recommended defensive actions

• Upgrade mySCADA myPRO Manager to version 1.4 or later using the vendor's published download path.
• Inventory all installations of mySCADA myPRO Manager and confirm which versions are in use.
• Review whether any exposed or stored credentials may need to be rotated after remediation.
• Restrict access to systems and files that may contain stored credentials until the upgrade is complete.
• Apply CISA industrial control system security best practices for credential management and system hardening.
• Validate that backup images, exports, and configuration files do not retain cleartext secrets.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-25-044-16 and the associated CVE record. The advisory explicitly states that the affected product stores credentials in cleartext and lists mySCADA myPRO Manager < 1.4 as the affected range. The vendor remediation in the advisory is to update to myPRO Manager v1.4. No KEV entry or ransomware-campaign linkage was provided in the supplied corpus.

Official resources