Critical flaws in myPRO HMI/SCADA product could allow takeover vulnerable systems

A researcher found a dozen vulnerabilities in mySCADA myPRO product, some of which have been rated as critical.

mySCADA myPRO is a multiplatform, human-machine interface (HMI) and supervisory control and data acquisition (SCADA) system that allows to visualize and control industrial processes.

The security researcher Michael Heinzl discovered multiple vulnerabilities in the myPRO product, some of which have been rated as critical severity. The flaws affect myPRO versions 8.20.0 and prior.

Heinzl published a security advisory for each of the vulnerabilities he discovered.

“The specific flaw exists within the parsing of HMI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. Local attackers are able to exploit this issue to execute arbitrary code on affected installations of Cscape EnvisionRV. User interaction is required to exploit the vulnerability in that a user must open a malicious HMI file.” reads the advisory for the CVE-2021-44462 Horner Automation Cscape EnvisionRV HMI File Parsing Out-of-Bounds Write vulnerability.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) also published two security advisories, in August and December respectively, to warn of these vulnerabilities.

The vulnerabilities impact organizations operating in critical infrastructure sectors, such as energy, food and agriculture, transportation systems, water and wastewater systems.

Some of these issues were addressed by the vendor in July with the release of version 8.20.0, while a second block of flaws was patched in November with the release of version 8.22.0.

The exploitation of the addressed issues can allow to obtain sensitive information, upload arbitrary files remotely, bypass authentication, and OS command injection.

Chaining some of the vulnerabilities, a remote, unauthenticated attacker can take complete control of the vulnerable systems.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, myPRO)

[adrotate banner=”5″]

[adrotate banner=”13″]