mySCADA myPRO Manager (CVE-2026-73807, CVE-2026-82567)
mySCADA myPRO Manager <=2.1 has unauthenticated command API and SMS gateway endpoints enabling privileged access and arbitrary SMS sending; update to version 2.2. CVE-2026-73807 (CVSS 9.8) allows unauthenticated network access to privileged command API functions in mySCADA myPRO Manager. CVE-2026-82567 exposes an unauthenticated HTTP endpoint that sends arbitrary SMS via a connected GSM modem. Both flaws affect versions <=2.1; vendor fixed in 2.2.
Detection / Hunteropenrouter
Immediate Actions
- Update mySCADA myPRO Manager to version 2.2 immediately
- Block all internet access to mySCADA myPRO Manager appliances
- Restrict network access to mySCADA appliances to admin subnets only
Key Takeaways
- CVE-2026-73807 scored CVSS 9.8 Critical under v3.1 metrics
- CVE-2026-82567 scored CVSS 6.3 Medium under v3.1 metrics
- Affected product versions: mySCADA myPRO Manager <=2.1
- Fix available in version 2.2; users notified if device is internet-connected
- No known public exploitation reported as of 2026-09-15
- Reporter: Shirshak Secnora OÜ
Attack Chain
- Reconnaissance: Attacker identifies mySCADA myPRO Manager instance on the network
- Initial Access: Unauthenticated access to command API via CVE-2026-73807
- Execution: Privileged management functions invoked without authentication
- Impact: Arbitrary SMS messages sent via GSM modem through CVE-2026-82567 endpoint
Affected Systems
- mySCADA myPRO Manager <=2.1
- Critical Manufacturing sector ICS deployments
- Energy sector ICS deployments
- Water and Wastewater sector ICS deployments
- Transportation Systems sector ICS deployments
- Food and Agriculture sector ICS deployments
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-73807 | mySCADA myPRO Manager | Critical | Command API lacks authentication enforcement for privileged functions, enabling unauthenticated access. |
| CVE-2026-82567 | mySCADA myPRO Manager | Medium | Unauthenticated HTTP endpoint allows sending arbitrary SMS via connected GSM modem. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | ICS management appliance; EDR coverage unlikely on embedded or appliance OS. |
| Network Visibility | High | Both vulnerabilities are network-accessible HTTP endpoints; traffic is inspectable. |
| Detection Difficulty | Moderate | Unauthenticated API calls to mySCADA endpoints; requires knowledge of API paths. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Unauthenticated HTTP requests to mySCADA myPRO Manager command API paths indicate exploitation of CVE-2026-73807 (T1190). | HTTP proxy or firewall logs to mySCADA appliance | Initial Access | Low — legitimate admin access uses authenticated sessions |
| HTTP requests to SMS notification gateway endpoint without prior authentication indicate CVE-2026-82567 exploitation (T1190). | HTTP access logs on mySCADA appliance | Execution | Low — legitimate SMS sends require authenticated session |
Required Log Sources
- HTTP proxy logs
- Network flow data
- Firewall logs
- ICS appliance access logs
Key Behavioral Indicators
- Unauthenticated HTTP requests to mySCADA command API
- HTTP POST to SMS gateway endpoint without session cookie
- Network traffic to mySCADA appliance from non-admin subnets
- Unexpected SMS activity from GSM modem connected to mySCADA
Control Gaps
- Network segmentation between ICS and business networks
- Firewall rules blocking internet exposure of mySCADA appliances
- Authentication enforcement on command API endpoints
False Positive Assessment
Low — unauthenticated access to privileged API and SMS endpoints is abnormal for legitimate mySCADA usage.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Place mySCADA appliances behind firewalls isolated from business networks
- Use VPN for remote access to ICS networks
- Monitor HTTP traffic to mySCADA command API and SMS gateway endpoints
User Protection
- Notify ICS operators of SMS spoofing risk from compromised mySCADA appliances
- Verify SMS alerts received from mySCADA systems for legitimacy
MITRE ATT&CK Mapping
Initial Access
Privilege Escalation
Plain-Language Summary
A product used to manage industrial control systems has two security flaws. One lets an attacker reach privileged management functions without a password. The other lets an attacker send arbitrary text messages through a connected cellular modem. Organizations in critical infrastructure sectors worldwide are affected. Update to version 2.2 immediately and isolate the system from the internet.
- cveCVE-2026-73807Command API lacks authentication enforcement for privileged functions, enabling unauthenticated access.
- cveCVE-2026-82567Unauthenticated HTTP endpoint allows sending arbitrary SMS via connected GSM modem.