Skip to main content

Mypro CVE-2024-4708

CRITICAL
Use of Hard-coded Password (CWE-259)
2024-07-02 ics-cert@hq.dhs.gov
Authentication Bypass Mypro
9.3
CVSS 4.0 · Vendor: hq
Share

Severity by source

Vendor (hq) PRIMARY
9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (hq) · only source for this CVE.

CVSS VectorVendor: hq

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

1
CVE Published
Jul 02, 2024 - 23:15 cve.org
CRITICAL 9.3

DescriptionCVE.org

mySCADA myPRO

uses a hard-coded password which could allow an attacker to remotely execute code on the affected device.

AnalysisAI

mySCADA myPRO uses a hard-coded password which could allow an attacker to remotely execute code on the affected device. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-259. mySCADA myPRO uses a hard-coded password which could allow an attacker to remotely execute code on the affected device. Affected products include: Myscada Mypro.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Mypro

View all
CVE-2025-24865 CRITICAL POC
10.0 Feb 13

The administrative web interface of mySCADA myPRO Manager can be accessed without authentication which could allow an un
CVE-2025-22896 CRITICAL POC
9.2 Feb 13

mySCADA myPRO Manager stores credentials in cleartext, which could allow an attacker to obtain sensitive information. Ra
CVE-2023-28384 HIGH POC
8.8 Apr 27

mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary ope
CVE-2018-11311 CRITICAL POC
9.1 May 20

A hardcoded FTP username of myscada and password of Vikuk63 in 'myscadagate.exe' in mySCADA myPRO 7 allows remote attack
CVE-2021-44453 CRITICAL
9.8 Dec 23

mySCADA myPRO: Versions 8.20.0 and prior has a vulnerable debug interface which includes a ping utility, which may allow
CVE-2021-43987 CRITICAL
9.8 Dec 23

An additional, nondocumented administrative account exists in mySCADA myPRO Versions 8.20.0 and prior that is not expose
CVE-2021-43985 CRITICAL
9.8 Dec 23

An unauthenticated remote attacker can access mySCADA myPRO Versions 8.20.0 and prior without any form of authentication
CVE-2021-43984 CRITICAL
9.8 Dec 23

mySCADA myPRO: Versions 8.20.0 and prior has a feature where the firmware can be updated, which may allow an attacker to
CVE-2021-43981 CRITICAL
9.8 Dec 23

mySCADA myPRO: Versions 8.20.0 and prior has a feature to send emails, which may allow an attacker to inject arbitrary o
CVE-2021-23198 CRITICAL
9.8 Dec 23

mySCADA myPRO: Versions 8.20.0 and prior has a feature where the password can be specified, which may allow an attacker

CVE-2021-22657 CRITICAL
9.8 Dec 23

mySCADA myPRO: Versions 8.20.0 and prior has a feature where the API password can be specified, which may allow an attac
CVE-2025-25067 CRITICAL
9.3 Feb 13

mySCADA myPRO Manager is vulnerable to an OS command injection which could allow a remote attacker to execute arbitrary

Same weakness CWE-259 – Use of Hard-coded Password

View all
CVE-2025-57788 MEDIUM POC
6.9
CVE-2012-5862 CRITICAL POC
10.0
CVE-2024-42639 CRITICAL POC
9.8
CVE-2024-36526 CRITICAL POC
9.8
CVE-2024-38902 CRITICAL POC
9.8
CVE-2023-5222 CRITICAL POC
9.8
CVE-2023-3237 CRITICAL POC
9.8
CVE-2023-2645 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2024-4708 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy