CVE-2024-45373 Dover Fueling Solutions (DFS) CVE debrief

Who should care

Organizations operating fueling stations, petroleum terminals, or industrial fuel management systems using Dover Fueling Solutions ProGauge MAGLINK LX or LX4 CONSOLE equipment. This includes fuel retailers, fleet operators, petroleum distributors, and critical infrastructure operators in the energy sector who rely on these systems for inventory management, tank monitoring, and fuel dispensing operations. Security teams responsible for OT/ICS environments and compliance officers managing NERC CIP or sector-specific security requirements should prioritize assessment and remediation.

Technical summary

The vulnerability stems from improper access control in the MAGLINK LX4 CONSOLE authentication and authorization subsystem. After successful authentication, the system fails to enforce privilege boundaries, allowing authenticated users to self-elevate to administrator status. This represents a broken access control weakness (CWE-269) where the application does not properly restrict users from gaining privileges by performing unauthorized actions. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects network attack vector, low attack complexity, low privileges required, no user interaction, and high impacts to confidentiality, integrity, and availability.

Defensive priority

HIGH

Recommended defensive actions

• Apply software update version 4.19.10 for MagLink LX console through DFS authorized service organizations. Contact DFS customer support at 877-679-8324 for North American installation assistance.
• Install MagLink consoles behind firewalls to restrict network access and reduce attack surface.
• Monitor for and install security updates on a timely basis through the DFS proprietary portal available to registered customers.
• Consider operating MagLink consoles offline or disconnected from networks where operational requirements permit.
• Review and enforce principle of least privilege for all user accounts on affected systems.
• Implement network segmentation to isolate fueling system consoles from untrusted networks.

Evidence notes

CISA published advisory ICSA-24-268-04 on 2024-09-24 documenting this vulnerability. The source indicates that once logged in to ProGauge MAGLINK LX4 CONSOLE, a valid user can change their privileges to administrator. Affected versions include ProGauge MAGLINK LX CONSOLE <=3.4.2.2.6 and ProGauge MAGLINK LX4 CONSOLE <=4.17.9e.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.