PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-41725 Dover Fueling Solutions (DFS) CVE debrief

A stored cross-site scripting (XSS) vulnerability exists in Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE and MAGLINK LX4 CONSOLE due to insufficient input filtering on fields used to render web pages. The vulnerability, published on September 24, 2024, carries a CVSS 3.1 score of 8.8 (HIGH), indicating significant risk through network attack vectors with low complexity and no required privileges. Affected versions include MAGLINK LX CONSOLE 3.4.2.2.6 and earlier, and MAGLINK LX4 CONSOLE 4.17.9e and earlier. Successful exploitation could allow an attacker to execute arbitrary scripts in a user's browser context, potentially leading to session hijacking, credential theft, or unauthorized administrative actions on fueling infrastructure management consoles.

Vendor
Dover Fueling Solutions (DFS)
Product
ProGauge MAGLINK LX CONSOLE
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-09-24
Original CVE updated
2024-09-24
Advisory published
2024-09-24
Advisory updated
2024-09-24

Who should care

Organizations operating fueling stations, petroleum terminals, or fleet fueling facilities using Dover Fueling Solutions ProGauge MAGLINK LX or LX4 CONSOLE systems. Critical infrastructure operators in the energy sector with OT/ICS environments. Managed service providers supporting fueling infrastructure. Security teams responsible for industrial control system asset protection and patch management.

Technical summary

The ProGauge MAGLINK LX CONSOLE and LX4 CONSOLE web interfaces fail to properly sanitize user-supplied input in fields used for page rendering, enabling stored cross-site scripting attacks. The vulnerability is remotely exploitable without authentication (AV:N/PR:N) but requires user interaction (UI:R) to trigger the malicious payload. Impact confidentiality, integrity, and availability are all rated HIGH (C:H/I:H/A:H). The attack surface is the console's web management interface, commonly deployed in fueling station environments for tank monitoring and fuel management operations.

Defensive priority

HIGH

Recommended defensive actions

  • Apply vendor patch: Update MAGLINK LX CONSOLE and LX4 CONSOLE to version 4.19.10 or later through Dover Fueling Solutions authorized service organizations.
  • Network segmentation: Install MAGLINK consoles behind firewalls with restricted network access; consider operating consoles offline or disconnected from networks where operational requirements permit.
  • Access controls: Implement principle of least privilege for console administrative access and enable multi-factor authentication where supported.
  • Input validation: Deploy web application firewall (WAF) rules or proxy filtering to sanitize input fields until patches are applied.
  • Monitoring: Enable logging and monitoring for anomalous script injection attempts or unexpected outbound connections from console systems.
  • Vendor engagement: Contact DFS customer support at 877-679-8324 for North American support regarding update installation and operational security questions.
  • Vulnerability management: Register for DFS proprietary customer portal to receive technical bulletins, security updates, and timely patch notifications.

Evidence notes

Source: CISA CSAF advisory ICSA-24-268-04. Affected product versions confirmed through CSAF product tree: MAGLINK LX CONSOLE <=3.4.2.2.6 and MAGLINK LX4 CONSOLE <=4.17.9e. CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Remediation version 4.19.10 released by vendor.

Official resources

2024-09-24