CVE-2025-5310
📋 TL;DR
Dover Fueling Solutions ProGauge MagLink LX Consoles expose an undocumented, unauthenticated target communication framework (TCF) interface on a specific port, allowing attackers to create, delete, or modify files remotely. This vulnerability can lead to remote code execution with critical impact. Organizations using these fuel management consoles in industrial control systems are affected.
💻 Affected Systems
- Dover Fueling Solutions ProGauge MagLink LX Consoles
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attackers to execute arbitrary code, disrupt fuel operations, manipulate fueling data, or pivot to other industrial systems.
Likely Case
Unauthorized file manipulation leading to service disruption, data corruption, or installation of malware for persistence.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external access to the vulnerable interface.
🎯 Exploit Status
The vulnerability requires no authentication and allows direct file manipulation, making exploitation straightforward for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Specific version not provided in references - consult vendor advisory
Vendor Advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-25-168-05
Restart Required: Yes
Instructions:
1. Contact Dover Fueling Solutions for patch availability 2. Apply vendor-provided firmware update 3. Restart affected consoles 4. Verify patch application
🔧 Temporary Workarounds
Network Segmentation and Firewall Rules
allBlock access to the TCF interface port using network firewalls and segment affected consoles from untrusted networks.
Access Control Lists
allImplement strict network access controls to limit which systems can communicate with the vulnerable port.
🧯 If You Can't Patch
- Isolate affected consoles in a dedicated network segment with no internet access
- Implement strict firewall rules to block all traffic to the TCF interface port from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check if ProGauge MagLink LX consoles are accessible on the TCF interface port (port number not specified in references) and respond to unauthenticated file manipulation requests.Check Version:
Consult console management interface or vendor documentation for firmware version informationVerify Fix Applied:
Verify that the TCF interface no longer accepts unauthenticated connections or file operations after applying vendor patches.📡 Detection & Monitoring
Log Indicators:
- Unauthorized connection attempts to TCF interface port
- Unexpected file creation/modification/deletion events on console
Network Indicators:
- Traffic to the TCF interface port from unauthorized sources
- Unusual file transfer patterns to/from console
SIEM Query:
source_ip OUTSIDE trusted_networks AND dest_port = [TCF_PORT] AND protocol = TCP🔗 References
- https://ociocisa.sharepoint.com/teams/JCDC-ProductionOffice/Shared%20Documents/Forms/AllItems.aspx?OR=Teams%2DHL&CT=1736953471669&id=%2Fteams%2FJCDC%2DProductionOffice%2FShared%20Documents%2FPublications%2FICS%20Publishing%2F2025%20ICSAs%2FJUN%2017%2FVU%23285756%20%2D%20Dover%20Fueling%20Solutions%20ProGauge%20MAGLINK%20%2D%20Notice%20%28Draft%29%2Ehtml&viewid=243fd1ea%2Da122%2D4cc0%2Dbe91%2Dd0714ca46b87&parent=%2Fteams%2FJCDC%2DProductionOffice%2FShared%20Documents%2FPublications%2FICS%20Publishing%2F2025%20ICSAs%2FJUN%2017
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-168-05
