CVE-2024-43423 Dover Fueling Solutions (DFS) CVE debrief

Who should care

Organizations operating fuel management systems, particularly in critical infrastructure sectors including petroleum distribution, retail fueling stations, fleet fueling operations, and industrial fuel storage facilities. Security teams responsible for OT/ICS environments, network administrators managing isolated industrial networks, and compliance officers overseeing NERC CIP or sector-specific security requirements should prioritize assessment and remediation.

Technical summary

The ProGauge MAGLINK LX CONSOLE web application contains an administrative-level user account with a hardcoded password that cannot be changed by users. This design flaw allows any attacker with network access to authenticate as an administrator without prior credentials. The vulnerability is remotely exploitable with low attack complexity, requires no privileges or user interaction, and results in complete system compromise. Affected products include MAGLINK LX CONSOLE (≤3.4.2.2.6) and MAGLINK LX4 CONSOLE (≤4.17.9e). Dover Fueling Solutions has released version 4.19.10 to remediate this issue.

Defensive priority

critical

Recommended defensive actions

• Contact Dover Fueling Solutions customer support at 877-679-8324 to obtain and install software update version 4.19.10 for MAGLINK LX4 CONSOLE, which addresses this vulnerability
• Deploy MAGLINK consoles behind network firewalls to restrict unauthorized network access
• Implement network segmentation to isolate fuel management systems from untrusted networks
• Monitor for and apply security updates on a timely basis through DFS's authorized service organizations
• Consider operating MAGLINK consoles offline or disconnected from networks where operational requirements permit
• Access technical bulletins and updates through the DFS proprietary portal if you are a registered MagLink customer
• Review CISA's ICS recommended practices for additional defensive guidance on securing industrial control systems

Evidence notes

CISA published advisory ICSA-24-268-04 on September 24, 2024, identifying this hardcoded credential vulnerability in ProGauge MAGLINK LX and LX4 CONSOLE systems. The advisory confirms affected versions and vendor-provided remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.