CVE-2024-52034

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

An OS Command Injection vulnerability exists within myPRO Manager. A parameter within a command can be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
mySCADA	myPRO Manager	< 1.3
mySCADA	myPRO Runtime	< 9.2.1
myscada	mypro_manager	< 1.3
myscada	mypro_runtime	< 9.2.1

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-07

Timeline

Published: Nov 22, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-520357.8An integer overflow vulnerability exists in the OLE Document File Allocation Table Parser functionality of catdoc 0.95. A specially crafted CVE-2024-52048.8The Swiss Toolkit For WP plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0.7. This is due to CVE-2024-520435.3Generation of Error Message Containing Sensitive Information in HumHub GmbH & Co. KG - HumHub on Linux allows: Excavation (user enumeration)CVE-2024-520469.8The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process incoming serialized data but lacks the CVE-2024-520478.8A widget local file inclusion vulnerability in Trend Micro Apex One could allow a remote attacker to execute arbitrary code on affected inst CVE-2024-520487.8A LogServer link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installatio CVE-2024-520497.8A LogServer link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installatio CVE-2024-52056.4The Videojs HTML5 Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's videojs_video shortcode in all v CVE-2024-520507.8A LogServer arbitrary file creation vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected in CVE-2024-520517.3A vulnerability has been identified in SIMATIC S7-PLCSIM V17 (All versions), SIMATIC S7-PLCSIM V18 (All versions), SIMATIC STEP 7 Safety V17 CVE-2024-520527.2Wowza Streaming Engine below 4.9.1 permits an authenticated Streaming Engine Manager administrator to define a custom application property a CVE-2024-520539.6Stored Cross-Site Scripting in the Manager component of Wowza Streaming Engine below 4.9.1 allows an unauthenticated attacker to inject clie