CVE-2025-24865 is a critical missing authentication flaw (CVSS 10.0) in the mySCADA myPRO Manager administrative web interface, which can be reached without a login to read sensitive information and upload files. The record lists no fixed version. Remove internet exposure, restrict access and read CISA advisory ICSA-25-044-16.
What's affected
The NVD record names mySCADA myPRO. The description says the administrative web interface of myPRO Manager can be accessed without authentication, which could let an unauthorized attacker retrieve sensitive information and upload files without the associated password.
The record gives no version range, so the CISA advisory and the vendor download page are where to confirm which releases are affected. The vector shows network access, low complexity, no privileges, no interaction and a changed scope, with high impact on all three of confidentiality, integrity and availability, which is how it reaches a 10.0.
The record is not on the CISA Known Exploited Vulnerabilities list, although CISA published an industrial control systems advisory for it, ICSA-25-044-16.
The weakness is classed as CWE-306 (missing authentication for a critical function). The score is 10.0 (CRITICAL). The vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, reads as reachable over the network, low attack complexity, no privileges required and no user interaction. Impact is high on confidentiality, high on integrity and high on availability. The record was published on 2025-02-13.
The record names no fixed version. It lists the mySCADA download page for myPRO Manager. Check it and the CISA advisory, and ask the vendor which release closes the issue before you assume you are covered.
How to check if you're exposed
Treat this as an inventory and exposure check. Work with the owner of the SCADA environment.
- Find every myPRO Manager install and record the version from its interface or installer.
- Check whether its administrative web interface is reachable from the internet. Ask your network team for any firewall rules or port forwards that publish it.
- Check where it sits in your network. SCADA management tools belong in a segment away from office and guest traffic.
- Review any files in upload locations, and review who has reached the admin interface recently if logs exist.
Do not probe production control systems without the operator's written approval and a safe test plan.
What to do now
- Take the myPRO Manager administrative interface off the internet right away if it is exposed.
- Put it behind a VPN or a firewall that allows only named management addresses.
- Ask mySCADA for the release that addresses this CVE, and apply it in a planned change window.
- Review the server for unexpected uploaded files, and treat any stored credentials or keys as potentially seen if the interface was exposed.
- Follow the mitigations in CISA advisory ICSA-25-044-16.
Why it matters
Missing authentication for a critical function, listed as CWE-306, means the interface does not ask who is calling before it lets them do something important. This is not a subtle bug. It is a gate that was never built, so there is nothing to bypass.
A score of 10.0 is rare and reflects how little stands in the way: reach the interface and you can read data and put files on the server. In a control system, the management server often holds credentials and connection details for devices on the plant floor, which is why exposure on the internet is the first thing to remove.
If you track many applications, the free in-browser dependency scan at gold.safeguard.sh/scan can show which of your components have known CVEs, and the Gold directory lists each one with its fix status.
Quick check
Is CVE-2025-24865 exploited in the wild?
The record is not on the CISA Known Exploited Vulnerabilities list, and I found no advisory text stating it. CISA published an ICS advisory about it, which is a different thing.
What is the first thing to do?
Make sure the administrative interface is not reachable from the internet, then work on getting the vendor fix.
Sources
- Safeguard Gold entry for CVE-2025-24865
- NVD record data for CVE-2025-24865 (published 2025-02-13)
- CISA ICS advisory ICSA-25-044-16 (listed in the record)
Last reviewed: 19 October 2026.
