CVE-2025-25067 is a critical (CVSS 9.8) OS command injection flaw in mySCADA myPRO Manager. A remote caller needs no login to run operating system commands. CISA's advisory lists versions prior to 1.4 as affected, so move to 1.4 or later, keep the product off the internet, and read the advisory for the full set of issues.
What's affected
- Product: mySCADA myPRO Manager, software used in industrial control and SCADA environments.
- Affected: versions prior to 1.4, according to CISA advisory ICSA-25-044-16.
- Fixed: the advisory points to version 1.4 or later. Confirm the exact release and download source on the mySCADA site before you install.
- Related issues: the same advisory covers missing authentication on the administrative web interface, cleartext credential storage and cross site request forgery, each with its own CVE. This post covers only CVE-2025-25067.
- Access: network reachable, no authentication and no user interaction, which is how the vector reaches 9.8.
How to check if you're exposed
Find the installed version through the product's own interface or install directory, and compare it with 1.4. Because this is control system software, do the next part carefully and with the plant or site owner involved.
Identify every host that runs myPRO Manager and whether it is reachable from a business network or the internet. A network scan of your own address space for the product's web ports helps, as does a review of firewall rules that allow inbound traffic to those hosts.
nmap -Pn -p 80,443 <your-public-range>
If any instance answers from the internet, treat it as an urgent finding. The advisory describes the web interface as reachable without authentication for related flaws, so exposure means more than this one bug.
What to do now
- Update myPRO Manager to 1.4 or later using the vendor's download page, following the site's change process.
- Take any internet reachable instance offline from the internet right away, or place it behind a VPN with multi factor authentication.
- Segment the host so only the engineering workstations and systems that need it can reach it.
- Read the full CISA advisory for the other three issues and apply every listed fix, since they combine badly.
- Review credentials stored by the product and change them after you update, because one related issue involves cleartext storage.
- Follow CISA's general ICS guidance on minimising exposure and running defence in depth.
Why it matters
The weakness is OS command injection. A parameter that reaches the product's backend is placed into a system command without neutralising special characters, which lets a remote caller add commands of their own.
- CWE-78 is improper neutralization of special elements in an operating system command. Input is placed into a command string that the system then runs, so the caller can add commands of their own.
SCADA tooling sits close to physical processes, so a compromise can matter beyond data loss. These products are also commonly installed once and left alone for years, which makes version tracking easy to forget. The CISA advisory notes the issue is exploitable remotely with low attack complexity. It does not claim exploitation in the wild, and our record does not flag this CVE in the KEV catalog.
The practical lesson is the same as for most industrial software. Do not rely on a patch alone. Keep management interfaces away from the internet, split networks by function, and keep an inventory that says which version each site runs.
Quick check
Which version of myPRO Manager is fixed?
CISA's advisory lists versions prior to 1.4 as affected, so use 1.4 or later and confirm with the vendor.
Does the same advisory cover other flaws?
Yes. It also covers missing authentication, cleartext credential storage and cross site request forgery, each with its own CVE.
Sources
Last reviewed: 19 October 2026.
