module
mySCADA myPRO Manager Credential Harvester (CVE-2025-24865 and CVE-2025-22896)
| Disclosed |
|---|
| Feb 13, 2025 |
Disclosed
Feb 13, 2025
Description
Credential Harvester in MyPRO Manager The product suffers from a broken authentication vulnerability (CVE-2025-24865) for certain functions. One of them is the configuration page for notifications, which returns the cleartext credentials (CVE-2025-22896) before correctly veryfing that the associated request is coming from an authenticated and authorized entity.
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.