Dover Fueling Solutions ProGauge MagLink LX4 Devices
Act Now9.8ICS-CERT ICSA-25-261-07Sep 18, 2025
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
Multiple vulnerabilities (CWE-190, CWE-321, CWE-1391) in ProGauge MagLink LX 4, LX Plus, and LX Ultimate firmware allow remote unauthenticated attackers to cause a denial-of-service condition or gain administrative access to the device. The vulnerabilities stem from improper input validation (integer overflow), hardcoded or insecurely stored credentials, and unspecified additional flaws that could allow complete device compromise.
What this means
What could happen
An attacker could remotely shut down fueling operations by causing the device to crash, or gain full administrative control to alter fuel inventory records, pricing, or delivery operations without authentication.
Who's at risk
Fueling station operators and fleet managers using Dover ProGauge MagLink devices for inventory management, transaction tracking, and remote monitoring. This includes both retail fuel retailers and commercial/fleet fueling operations. The vulnerability affects all three MagLink product lines (LX 4, LX Plus, and LX Ultimate).
How it could be exploited
An attacker on the network sends a malformed request to an unpatched ProGauge MagLink device (via its network interface, likely port 502 or HTTP management interface). The device fails to properly validate input or handle numeric operations (CWE-190), potentially allowing the attacker to bypass authentication checks or extract hardcoded credentials (CWE-321) and gain admin access.
Prerequisites
- Network access to the ProGauge MagLink device—either directly from the internet or from a compromised internal/business network
- Unpatched firmware version (LX4/LX Plus below 4.20.3, or LX Ultimate below 5.20.3)
Remotely exploitableNo authentication requiredLow attack complexityNo patch available (vendor confirmed no fix)High CVSS severity (9.8)Affects critical fueling infrastructure
Exploitability
Low exploit probability (EPSS 0.1%)
Affected products (3)
3 with fix
ProductAffected VersionsFix Status
ProGauge MagLink LX 4: <4.20.3<4.20.34.20.3
ProGauge MagLink LX Plus: <4.20.3<4.20.34.20.3
ProGauge MagLink LX Ultimate: <5.20.3<5.20.35.20.3
Remediation & Mitigation
0/4
Do now
0/1HARDENINGPlace all ProGauge MagLink devices behind a firewall with restrictive inbound rules; do not expose them directly to the internet or untrusted networks.
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXUpdate ProGauge MagLink LX 4 and LX Plus devices to firmware version 4.20.3 or later; update MagLink LX Ultimate to version 5.20.3 or later. Downloads available from Dover Fueling Solutions website.
Long-term hardening
0/2HARDENINGIsolate the control system network (where fueling devices reside) from the business/corporate network using network segmentation or air-gapping.
HARDENINGIf remote access to devices is required, use a VPN with the most current security updates and strong authentication; restrict VPN access to authorized personnel only.
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/55fad13f-b1f8-4d24-a94f-ab0ade4ea6bb