Description (CNA)
The secret used for validating authentication tokens is hardcoded in device firmware for affected versions. An attacker who obtains the signing key can bypass authentication, gaining complete access to the system.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Dover Fueling Solutions / ProGauge MagLink LX 4 | affected 0 before 4.20.3 |
| Dover Fueling Solutions / ProGauge MagLink LX Plus | affected 0 before 4.20.3 |
| Dover Fueling Solutions / ProGauge MagLink LX Ultimate | affected 0 before 5.20.3 |
CWE
CWE-321
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-07
- https://www.doverfuelingsolutions.com/mea/en/products-and-solutions/automatic-tank-gauging/consoles/progauge-maglink-lx-4-console.html
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-261-07.json
ADP enrichment
No English description supplied.
No references supplied.