CVE-2024-45066

An attacker sends a specially crafted HTTP POST request to the IP configuration submenu in the web interface of the ProGauge MAGLINK LX console. Input data submitted in this request is not properly validated or filtered, allowing injection and execution of arbitrary system commands (CWE-77: Improper Neutralization of Special Elements used in a Command). The attack does not require account possession or any form of authentication, and its execution does not require user interaction.

Attackers gain the ability to remotely execute arbitrary commands on the device, which can lead to complete takeover of the console, manipulation of measurement data, and potential disruption of fuel station infrastructure operations.

Apply patches available from the manufacturer in accordance with the references (CISA ICS Advisory ICSA-24-268-04). Additionally, it is recommended to restrict network access to the device management interface exclusively to trusted hosts and to isolate OT/ICS devices from the public Internet using firewalls or VLAN networks.

Dover Fueling Solutions ProGauge MAGLINK LX Console and ProGauge MAGLINK LX4 Console firmware and consoles — versions indicated in the manufacturer's references (ICS Advisory ICSA-24-268-04)