CVE-2024-47407

A parameter within a command does not properly validate input within myPRO Manager which could be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands.

Score

CVSS 4.0 10.0 Critical

Status

Deferred - ics-cert@hq.dhs.gov

Published

2024-11-22

Last modified

2024-11-25

Weaknesses

CWE-78

Affected products

• Mypro Manager (Myscada)
• Mypro Runtime (Myscada)

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-07