CVE-2024-43423

The manufacturer embedded an administrative account with a hard-coded password in the firmware that cannot be changed by the administrator or system user. This type of vulnerability (CWE-259, CWE-798) means that the password is identical across all device instances. An attacker who learns this password—for example, through firmware analysis or from publicly available sources—can freely log into the administrative panel over the network without requiring any prior privileges.

An attacker gains full administrative access to the console managing the fuel measurement system, which may enable manipulation of measurement data, modification of device configuration, or disruption of fuel station infrastructure operations.

Apply patches available from the manufacturer in accordance with the references (CISA ICS advisory ICSA-24-268-04). Until updates are applied, it is recommended to isolate devices from the public network, restrict network access to the web panel to trusted IP addresses only, and monitor access logs for unauthorized login attempts.

Dover Fueling Solutions ProGauge MAGLINK LX Console (firmware and software) and ProGauge MAGLINK LX4 Console (firmware and software)—specific versions indicated in manufacturer references (ICSA-24-268-04)