CVE-2024-47407 CRITICAL

CVE-2024-47407: mySCADA myPRO OS Command Injection

Vendor Myscada
Product myPRO Manager
Weakness CWE-78
Published November 22, 2024
Last update November 25, 2024
View on NVD All CVEs

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

A parameter within a command does not properly validate input within myPRO Manager which could be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands.

Key dates

02Disclosure timeline

November 22, 2024 CVE published
November 25, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-40505 LG Simple Editor createThumbnailByMovie Command Injection Remote Code Execution Vulnerability CVE-2026-45629 Dokploy: Authenticated Remote Code Execution via Command Injection in /listen-deployment WebSocket Endpoint CVE-2022-47555 Improper Neutralization of Special Elements in Ormazabal products CVE-2020-3377 Cisco Data Center Network Manager Command Injection Vulnerability CVE-2023-38208 Validate Your Inputs | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)