CVE-2024-4708 is a critical flaw in mySCADA myPRO, scored 9.8. The product uses a hard-coded password that could let an attacker run code remotely on the device. mySCADA recommends updating myPRO to v8.31.0. CISA advises keeping control systems off the internet and behind firewalls.
What's affected
The record lists mySCADA myPRO without a version range. The CISA advisory ICSA-24-184-02 gives the fix: mySCADA recommends updating myPRO to v8.31.0. Use that advisory to confirm which earlier builds are in scope for your install.
CISA calculates a CVSS v3.1 base score of 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and a CVSS v4 score of 9.3. The two weaknesses are CWE-259, use of a hard-coded password, and CWE-798, use of hard-coded credentials. The advisory lists Critical Manufacturing as the sector, worldwide deployment, and a Czech Republic headquarters for the vendor.
The KEV flag is false. The CISA advisory says no known public exploitation specifically targeting the flaw had been reported to CISA at the time of publication on 2 July 2024. That is a statement about the date it was written, so treat it as a snapshot.
How to check if you're exposed
- Find every myPRO instance, including test and engineering copies.
- Read the installed version in the application and compare it to v8.31.0.
- Check whether any instance is reachable from the internet or from a business network. Search your firewall rules and use an external exposure scan of your own address space.
- Ask the integrator who installed it whether default or built in credentials were ever changed.
An asset inventory is the quickest path. Operational technology often sits outside normal dependency scanning, so confirm the product list by hand and record its version next to the owner.
What to do now
- Update myPRO to v8.31.0 or later after testing in a safe copy, following the vendor's instructions.
- Take the system off the internet. CISA's guidance is to minimize network exposure for all control system devices.
- Place control networks behind firewalls and isolate them from business networks.
- Where remote access is needed, use a VPN, and keep the VPN current.
- Review logs for unexpected logins and for new files or processes on the host.
- Follow your own impact analysis before changing a live control system, as CISA reminds readers.
Try it yourself
Click through it at your own pace, or open it full screen.
Why it matters
A hard-coded password is a secret that ships inside the product, so everyone who runs it shares the same key. Anyone who learns it, by reading the software or the firmware, can try it on every reachable installation. There is nothing to guess and no lockout to trip.
That is why the score is 9.8: no privileges, no user action, and full impact. In industrial settings the effect can reach beyond data, into the process the software monitors. Updating helps, and so does the structural fix of not exposing these systems at all.
Quick check
Is a fix available?
Yes. The vendor, through the CISA advisory, recommends updating myPRO to v8.31.0.
Sources
- CISA advisory ICSA-24-184-02
- mySCADA myPRO product page
- NVD record data for CVE-2024-4708
Last reviewed: 19 October 2026.
