Threats affecting pkg:github/myscada/myPRO

CVE-2026-82567 is a medium severity vulnerability in mySCADA Technologies mySCADA myPRO affecting versions 0 through 2.1. The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint that allows sending SMS messages via a connected GSM modem without requiring authentication. An attacker with network access can exploit this to send arbitrary SMS messages.

CVE-2026-73807 is a critical vulnerability in the mySCADA myPRO Manager command API where authentication is not properly enforced for privileged functions. This allows an unauthenticated attacker with network access to invoke privileged management operations. The vulnerability affects versions from 0 up to and including 2.1 of mySCADA myPRO. The CVSS score is 9.8, indicating a high severity with full confidentiality, integrity, and availability impact.