CVE-2025-20014

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

mySCADA myPRO does not properly neutralize POST requests sent to a specific port with version information. This vulnerability could be exploited by an attacker to execute arbitrary commands on the affected system.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
mySCADA	myPRO Manager	< 1.3
mySCADA	myPRO Runtime	< 9.2.1

References

https://www.cisa.gov/news-events/ics-advisories/icsa-25-023-01

Timeline

Published: Jan 29, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-200156.7Uncontrolled search path element for some Intel(R) Ethernet Connection software before version 29.4 may allow an authenticated user to poten CVE-2025-200167.2OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340/D440 provided by Y'S corporation. A user with an a CVE-2025-200176.7Uncontrolled search path for some Intel(R) oneAPI Toolkit and component software installers may allow an authenticated user to potentially e CVE-2025-200188.4Untrusted pointer dereference for some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable escalation of privile CVE-2025-20026.0CWE-532: Insertion of Sensitive Information into Log Files vulnerability exists that could cause the disclosure of FTP server credentials wh CVE-2025-200215.5in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.CVE-2025-200225.7Insufficient control flow management for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow a privileged user to po CVE-2025-200236.7Incorrect default permissions for some Intel(R) Graphics Driver software installers may allow an authenticated user to potentially enable es CVE-2025-200245.3in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through integer overflow. Thi CVE-2025-200254.4Uncontrolled recursion for some TinyCBOR libraries maintained by Intel(R) before version 0.6.1 may allow an authenticated user to potentiall CVE-2025-200266.1Out-of-bounds read for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.100 may allow an unauthenticated user to po CVE-2025-200277.1Improper input validation in the UEFI WheaERST module for some Intel(R) reference platforms may allow an escalation of privilege. System sof