CVE-2024-43693

An attacker sends a specially crafted HTTP POST request to the UTILITY submenu in the ProGauge MAGLINK LX console interface. Input data contained in the request is not properly validated or sanitized, allowing injection and execution of arbitrary system commands (CWE-77). The attack does not require authentication, user interaction, or specific network conditions — only network access to the device is needed.

An attacker can execute arbitrary commands with the privileges of the process handling requests, which in practice may mean complete takeover of the device, manipulation of fuel measurement data, and potential impact on gas station infrastructure.

Patches available from the manufacturer should be applied in accordance with the references (CISA ICS Advisory ICSA-24-268-04). Additionally, it is recommended to restrict network access to the console interface through a firewall or OT/ICS network segmentation and isolate devices from the public Internet.

Dover Fueling Solutions ProGauge MAGLINK LX Console (firmware and console software) and ProGauge MAGLINK LX4 Console (firmware and console software) — specific versions indicated in manufacturer references (ICSA-24-268-04)