CVE-2021-43987

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An additional, nondocumented administrative account exists in mySCADA myPRO Versions 8.20.0 and prior that is not exposed through the web interface, which cannot be deleted or changed through the regular web interface.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-912

Affected software

Vendor	Product	Versions
mySCADA	myPRO	>= All, <= 8.20.0

References

https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-01Third Party Advisory, US Government Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-01Third Party Advisory, US Government Resource

Timeline

Published: Dec 23, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-439885.9The affected product is vulnerable to a network-based attack by threat actors utilizing crafted naming conventions of files to gain unauthor CVE-2021-439897.5mySCADA myPRO Versions 8.20.0 and prior stores passwords using MD5, which may allow an attacker to crack the previously retrieved password h CVE-2021-43998.8The Edwiser Bridge plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including,2.0.6. This is due to m CVE-2021-439905.3The affected product is vulnerable to a network-based attack by threat actors supplying a crafted, malicious XML payload designed to trigger CVE-2021-439915.4The Kentico Xperience CMS version 13.0 – 13.0.43 is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (also known as Store CVE-2021-439969.8The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix variable names" feature that can lead to incorrect acc CVE-2021-439977.8FreeRTOS versions 10.2.0 through 10.4.5 do not prevent non-kernel code from calling the xPortRaisePrivilege internal function to raise privi CVE-2021-439986.5HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias i CVE-2021-439998.8Apache Guacamole 1.2.0 and 1.3.0 do not properly validate responses received from a SAML identity provider. If SAML support is enabled, this CVE-2021-44004.3The Better Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.2. This is due to m CVE-2021-440007.8A vulnerability has been identified in JT2Go (All versions < V13.2.0.7), Solid Edge SE2021 (All versions < SE2021MP9), Solid Edge SE2022 (Al CVE-2021-440017.8A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The DL180pdfl.