by Kastro
Paper/Archive/CVE-2025-54807

CVE-2025-54807

Dover Fueling Solutions ProGauge MagLink LX 4 — Dover Fueling Solutions ProGauge MagLink LX 4 Devices Use of Hard-coded Cryptographic Key

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 54.9.549 × 2011.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The secret used for validating authentication tokens is hardcoded in device firmware for affected versions. An attacker who obtains the signing key can bypass authentication, gaining complete access to the system.

Affected

ProductAffectedFixed inSource
ProGauge MagLink LX 4< 4.20.34.20.3CNA
ProGauge MagLink LX Plus< 4.20.34.20.3CNA
ProGauge MagLink LX Ultimate< 5.20.35.20.3CNA

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
icscert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-25-261-07refdoverfuelingsolutions.com/mea/en/products-and-solutions/automatic-tank-gauging/consoles/progauge-maglink-lx-4-console.htmlrefgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-261-07.json