Paper/Archive/CVE-2024-43692

CVE-2024-43692

Dover Fueling Solutions (DFS) ProGauge MAGLINK LX CONSOLE — Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Authentication Bypass Using an Alternate Path or Channel

EPSS 0.5%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 43.4.434 × 208.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An attacker can directly request the ProGauge MAGLINK LX CONSOLE resource sub page with full privileges by requesting the URL directly.

Affected

ProductAffectedFixed inSource

ProGauge MAGLINK LX CONSOLE≤ 3.4.2.2.6–CNA

ProGauge MAGLINK LX4 CONSOLE≤ 4.17.9e–CNA

maglink_lx_console≤ 3.4.2.2.6–CISA-ADP

maglink_lx4_console≤ 4.17.9e–CISA-ADP

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

icscert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-24-268-04