CVE-2024-43693 Dover Fueling Solutions (DFS) CVE debrief

Who should care

Organizations operating Dover Fueling Solutions ProGauge MAGLINK LX or LX4 CONSOLE systems at fueling stations, petroleum terminals, or industrial fuel management facilities. Critical infrastructure operators in the energy sector with deployed MAGLINK console infrastructure should prioritize patching due to the unauthenticated remote exploitation vector and complete system compromise potential.

Technical summary

The ProGauge MAGLINK LX CONSOLE contains a command injection vulnerability in its UTILITY sub-menu. An unauthenticated remote attacker can send a specially crafted HTTP POST request to inject and execute arbitrary operating system commands. The vulnerability scores CVSS 3.1 10.0 (Critical) due to its network accessibility, lack of authentication requirements, and complete system compromise potential. Affected versions include MAGLINK LX CONSOLE 3.4.2.2.6 and earlier, and MAGLINK LX4 CONSOLE 4.17.9e and earlier. Dover Fueling Solutions has released version 4.19.10 to address this vulnerability.

Defensive priority

critical

Recommended defensive actions

• Apply software update version 4.19.10 for MagLink LX console through DFS authorized service organizations; contact DFS customer support at 877-679-8324 for North American installation assistance
• Install MagLink consoles behind firewalls to restrict network access
• Monitor for and install security updates on a timely basis
• Consider operating MagLink consoles offline or disconnected from networks where operational requirements permit
• Contact DFS customer support for questions regarding operations or software updates
• Registered MagLink customers should monitor the DFS proprietary portal for technical bulletins and updates

Evidence notes

CISA ICS advisory ICSA-24-268-04 confirms remote command injection via crafted POST request to UTILITY sub-menu. CVSS 3.1 score of 10.0 reflects network attack vector with no privileges required, no user interaction, and changed scope with high impact to confidentiality, integrity, and availability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.