CVE-2024-41725 Dover Fueling Solutions (DFS) CVE debrief

Who should care

Organizations operating fueling stations, petroleum terminals, or fleet fueling facilities using Dover Fueling Solutions ProGauge MAGLINK LX or LX4 CONSOLE systems. Critical infrastructure operators in the energy sector with OT/ICS environments. Managed service providers supporting fueling infrastructure. Security teams responsible for industrial control system asset protection and patch management.

Technical summary

The ProGauge MAGLINK LX CONSOLE and LX4 CONSOLE web interfaces fail to properly sanitize user-supplied input in fields used for page rendering, enabling stored cross-site scripting attacks. The vulnerability is remotely exploitable without authentication (AV:N/PR:N) but requires user interaction (UI:R) to trigger the malicious payload. Impact confidentiality, integrity, and availability are all rated HIGH (C:H/I:H/A:H). The attack surface is the console's web management interface, commonly deployed in fueling station environments for tank monitoring and fuel management operations.

Defensive priority

HIGH

Recommended defensive actions

• Apply vendor patch: Update MAGLINK LX CONSOLE and LX4 CONSOLE to version 4.19.10 or later through Dover Fueling Solutions authorized service organizations.
• Network segmentation: Install MAGLINK consoles behind firewalls with restricted network access; consider operating consoles offline or disconnected from networks where operational requirements permit.
• Access controls: Implement principle of least privilege for console administrative access and enable multi-factor authentication where supported.
• Input validation: Deploy web application firewall (WAF) rules or proxy filtering to sanitize input fields until patches are applied.
• Monitoring: Enable logging and monitoring for anomalous script injection attempts or unexpected outbound connections from console systems.
• Vendor engagement: Contact DFS customer support at 877-679-8324 for North American support regarding update installation and operational security questions.
• Vulnerability management: Register for DFS proprietary customer portal to receive technical bulletins, security updates, and timely patch notifications.

Evidence notes

Source: CISA CSAF advisory ICSA-24-268-04. Affected product versions confirmed through CSAF product tree: MAGLINK LX CONSOLE <=3.4.2.2.6 and MAGLINK LX4 CONSOLE <=4.17.9e. CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Remediation version 4.19.10 released by vendor.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.