CVE-2025-20061

CriticalRCE

Published: 29 January 2025

Published

29 January 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v4 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0023 45.5th percentile

Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-20061 is a critical-severity OS Command Injection (CWE-78) vulnerability in Cisa (inferred from references). Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-20061 is a critical vulnerability in mySCADA myPRO, published on 2025-01-29, where the software fails to properly neutralize POST requests sent to a specific port containing email information. Classified as CWE-78 (OS Command Injection), it enables arbitrary command execution on the affected system and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

The vulnerability can be exploited by any remote attacker with network access, requiring low attack complexity, no authentication privileges, and no user interaction. Successful exploitation allows the attacker to execute arbitrary commands, resulting in high impacts to confidentiality, integrity, and availability of the affected system.

Mitigation details are available in the CISA ICS Advisory ICSA-25-023-01 at https://www.cisa.gov/news-events/ics-advisories/icsa-25-023-01.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-2147

Vulnerability details

mySCADA myPRO does not properly neutralize POST requests sent to a specific port with email information. This vulnerability could be exploited by an attacker to execute arbitrary commands on the affected system.

CWE(s): CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

Why these techniques?

OS command injection (CWE-78) in a public-facing SCADA application directly enables remote unauthenticated arbitrary command execution (T1190) via crafted POST requests, facilitating use of command interpreters (T1059).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1