CVE-2024-43692

An attacker can bypass the authentication mechanism (CWE-288) by directly calling the URL of a protected resource in the console's web interface. The system does not properly verify whether the request comes from an authenticated user, granting full permissions access to anyone who knows or guesses the URL path. The attack is possible remotely over the network without any additional prerequisites.

An attacker gains full access to the administrative functions of the fuel system management console without the need to log in, which may enable manipulation of device configuration or reading of sensitive operational data.

Apply patches available from the manufacturer according to the references. It is also recommended to restrict network access to the console's web interface only to trusted hosts and to isolate OT/ICS devices from public networks using a firewall.

Dover Fueling Solutions ProGauge MAGLINK LX Console and ProGauge MAGLINK LX4 Console devices (console firmware and software) — specific versions indicated in the manufacturer's references (CISA guide ICSA-24-268-04)