CVE-2025-22896criticalCWE-312

CVE-2025-22896: critical vulnerability in mySCADA myPRO Manager

mySCADA myPRO Manager Cleartext Storage of Sensitive Information

Published · Updated

43Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 9.2epss 3.6%
from disclosure to weapon0 days
Published on NVDFeb 13
metasploitFeb 13
exploitation probability
3.6%top 11% of all CVEs
observed exploitation
nono source reports it
mySCADA myPRO Manager stores credentials in cleartext, which could allow an attacker to obtain sensitive information.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Affected products
mySCADA · myPRO Manager
Related CVEs — mySCADA myPRO Manager

In the same product, most dangerous first.

CVE-2024-47407CRITICALmySCADA myPRO OS Command InjectionEPSS 63.8%CVE-2025-24865CRITICALmySCADA myPRO Manager Missing Authentication for Critical FunctionEPSS 7.2%CVE-2024-52034CRITICALmySCADA myPRO OS Command InjectionEPSS 1.7%CVE-2025-25067CRITICALmySCADA myPRO Manager OS Command InjectionEPSS 1.7%CVE-2025-20061CRITICALmySCADA myPRO Manager OS Command InjectionEPSS 1.3%CVE-2025-20014CRITICALmySCADA myPRO Manager OS Command InjectionEPSS 1.3%
References
https://www.cisa.gov/news-events/ics-advisories/icsa-25-044-16https://www.myscada.org/contacts/https://www.myscada.org/downloads/mySCADAPROManager/