mySCADA myPRO Manager Cleartext Credential Storage Vulnerability

A vulnerability exists in mySCADA myPRO Manager versions prior to 1.4, where credentials are stored in cleartext. This flaw could enable an attacker to access sensitive information. Additionally, the application is susceptible to other vulnerabilities, including OS command injection, missing authentication for critical functions, and cross-site request forgery (CSRF).

Impact

Exploitation of this vulnerability could allow unauthorized access to sensitive information by retrieving stored credentials.

Remediation

Users are advised to update to mySCADA myPRO Manager version 1.4. CISA recommends minimizing network exposure for control system devices, using firewalls to isolate control system networks from business networks, and employing secure remote access methods such as VPNs.