Unauthenticated HTTP Endpoint Vulnerability in myPRO Manager by mySCADA
CVE-2026-82567
5.3MEDIUM
What is CVE-2026-82567?
The myPRO Manager notification gateway presents a critical flaw by exposing an unauthenticated HTTP endpoint that allows unauthorized users to send SMS messages through a connected GSM modem. This endpoint, which is accessible without any form of authentication, can be exploited by an attacker with network access, enabling them to send arbitrary SMS messages. This situation poses a significant security risk, as it could be leveraged for malicious purposes, such as spamming or phishing. Organizations using myPRO Manager should take immediate steps to secure their systems to prevent unauthorized access and potential exploitation.
Affected Version(s)
mySCADA myPRO 0 <= 2.1
mySCADA myPRO 2.2
References
CVSS V4
Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
SECNORA, Rajivarnan R. and Shirshak reported these vulnerabilities to CISA.