PT-2018-10633 · Myscada · Myscada Mypro

Pedro Sampaio · Published 2018-05-28 · Updated 2018-06-29 · CVE-2018-11517

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions mySCADA myPRO version 7

Description The issue allows remote attackers to discover all ProjectIDs in a project. This is achieved by sending specific requests to the TCP port 11010, using the "prj" parameter with values ranging from 870000 to 875000 in "t=0&rq=0" requests.

Recommendations For mySCADA myPRO version 7, restrict access to TCP port 11010 to minimize the risk of exploitation. Avoid using the prj parameter in requests to this port until the issue is resolved.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-11517

Affected Products

Myscada Mypro

References · 4

• 🔥 https://github.com/EmreOvunc/mySCADA-myPRO-7-projectID-Disclosure · Exploit
• https://osv.dev/vulnerability/CVE-2018-11517 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-11517 · Security Note
• https://emreovunc.com/blog/en/mypro_enum_projectid.rb · Note