CVE-2023-28384: mySCADA myPRO OS Command Injection via Exposed Parameters

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 8.8 with network reachability and high EPSS (98.7th percentile) make this a serious risk despite requiring authentication and not being in KEV.

What it is

mySCADA myPRO versions 8.26.0 and prior contain parameters that allow an authenticated user to inject arbitrary operating system commands. This is a CWE-78 OS command injection flaw in an industrial HMI/SCADA product, so successful exploitation can compromise the host running myPRO and potentially reach connected control systems.

Impact

An attacker with valid credentials can execute arbitrary OS commands on the myPRO host, gaining full control of that system (high confidentiality, integrity and availability impact). From there they could disrupt or manipulate industrial processes managed by the HMI.

Attack surface

Reachable over the network (AV:N) with low attack complexity and no user interaction, but it requires a low-privileged authenticated account (PR:L). The vulnerable parameters are the injection point.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is high at 0.4481 (98.7th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Upgrade mySCADA myPRO to a version later than 8.26.0 if available; treat patching as the first action.
• If immediate upgrade is not possible, restrict network access to myPRO management interfaces to trusted hosts and segments.
• Enforce least privilege and strong unique credentials for myPRO accounts; remove or disable unused accounts.
• Monitor and validate any input passed to myPRO parameters, and apply vendor or CISA ICS advisory guidance for hardening.
• Segment the myPRO host from broader IT and control networks to limit lateral movement after compromise.

Detection

• Monitor myPRO host process creation for unexpected child processes spawned by the application (e.g., cmd.exe, /bin/sh, powershell).
• Alert on anomalous outbound network connections from the myPRO server to untrusted hosts.
• Audit authentication logs for unusual or off-hours logins to myPRO, especially from new source IPs.
• Review application and OS logs for command strings or shell metacharacters in myPRO parameter inputs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.