Security1 publisher2 min readPublished
mySCADA myPRO Manager takes privileged commands from anyone who can reach its API
CISA says mySCADA myPRO Manager 2.1 and earlier does not enforce authentication on its command API or on the notification gateway that sends SMS through a connected GSM modem. Version 2.2 fixes both.
The Watch · Security desk
What happened
- CISA published an advisory on mySCADA myPRO Manager covering two vulnerabilities in version 2.1 and earlier, tracked as CVE-2026-73807 and CVE-2026-82567.
- A separate notification gateway endpoint accepts a phone number and a message body over HTTP and sends the text through the connected GSM modem without requiring authentication.
- mySCADA Technologies fixed both issues in version 2.2, which internet-connected installs are told about inside the product while everyone else must download the installer from the vendor's page.
- CISA lists deployments worldwide across five sectors: Critical Manufacturing, Energy, Food and Agriculture, Transportation Systems, and Water and Wastewater.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure An outsider with network reach gains a text-message sender that belongs to the plant, and the recipients are the numbers a SCADA notification gateway was configured to text.
- constraint Neither defect can be managed with credential hygiene or stronger logins, because no credential is checked; until 2.2 is installed, the only control left is who can route to the manager host.
- cost Every message an attacker pushes through the modem bills to the site's own mobile account, and the charges accrue until 2.2 is installed.
Take the SMS defect first, because it needs the least skill: one HTTP request, no credential, and the modem sends the message to whatever number the request supplies [3]. Anything that can route to the manager host can send that request [3]. CISA files it under CWE-306, missing authentication for a critical function [3].
The command API defect has more room in it. CISA classes that one as CWE-862, missing authorization, with an unauthenticated attacker holding network access to the API able to reach privileged management functions [2]. That phrase is as specific as the advisory gets about the reachable surface, and it does not report exploitation in the wild [10].
The affected range is version 2.1 and earlier, which puts every install in scope [1][12]. mySCADA Technologies closed both issues in 2.2 [4].
CISA's hardening advice in the same document is to keep control system devices off the internet and behind firewalls that isolate them from business networks, using VPNs where remote access is required [8]. A site that followed that advice will not get the in-product prompt about the new version, because the prompt only reaches instances connected to the internet [5]. Someone has to walk the asset list and check versions by hand.
The advisory attaches both CVE-2026-73807 and CVE-2026-82567 to the same version range and the same fix, without matching either identifier to a specific flaw [1][9]. So the two can be handled as one item: the 2.2 upgrade closes both [11]. Shirshak Secnora OÜ reported the pair to CISA [7].
What to watch
- A working proof of concept for the notification gateway endpoint would put internet-wide scanning ahead of patch windows for anything still on 2.1.
- Whether CISA revises the advisory to map each CVE to its flaw or to publish severity metrics.
- Any report of exploitation moves this from a patch item to an incident, since both defects are open to unauthenticated requests.