Summary
Successful exploitation of these vulnerabilities could allow a remote attacker to gain full control of the system.
Vulnerabilities 6
-
Critical 10.0
Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Command Injection
A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE UTILITY sub-menu can allow a remote attacker to inject arbitrary commands.
-
Critical 10.0
Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Command Injection
A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE IP sub-menu can allow a remote attacker to inject arbitrary commands.
-
Critical 9.8
Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Use of Hard-coded Password
The web application for ProGauge MAGLINK LX4 CONSOLE contains an administrative-level user account with a password that cannot be changed.
-
Critical 9.8
Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Authentication Bypass Using an Alternate Path or Channel
An attacker can directly request the ProGauge MAGLINK LX CONSOLE resource sub page with full privileges by requesting the URL directly.
-
High 8.8
Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Cross-site Scripting
ProGauge MAGLINK LX CONSOLE does not have sufficient filtering on input fields that are used to render pages which may allow cross site scripting.
-
High 8.8
Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Improper Privilege Management
Once logged in to ProGauge MAGLINK LX4 CONSOLE, a valid user can change their privileges to administrator.
Revision history
-
#1
Initial Publication
References
-
ICSA Advisory ICSA-24-268-04 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-04
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ncas/tips/ST04-014
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B