Lucene search

IcscertCVE-2024-45066

HistorySep 25, 2024 - 1:15 a.m.

CVE-2024-45066

2024-09-2501:15:43

CWE-77

icscert

web.nvd.nist.gov

progauge maglink lx

remote attacker

command injection

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVSS4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:H/VI:H/SI:H/VA:H/SA:H

AI Score

9.4

Confidence

High

EPSS

Percentile

9.6%

JSON

A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE IP
sub-menu can allow a remote attacker to inject arbitrary commands.

Affected configurations

Nvd

Node

doverfuelingsolutionsprogauge_maglink_lx_console_firmwareRange≤3.4.2.2.6

AND

doverfuelingsolutionsprogauge_maglink_lx_consoleMatch-

Node

doverfuelingsolutionsprogauge_maglink_lx4_console_firmwareRange≤4.17.9e

AND

doverfuelingsolutionsprogauge_maglink_lx4_consoleMatch-

VendorProductVersionCPE
doverfuelingsolutionsprogauge_maglink_lx_console_firmware*cpe:2.3:o:doverfuelingsolutions:progauge_maglink_lx_console_firmware:*:*:*:*:*:*:*:*
doverfuelingsolutionsprogauge_maglink_lx_console-cpe:2.3:h:doverfuelingsolutions:progauge_maglink_lx_console:-:*:*:*:*:*:*:*
doverfuelingsolutionsprogauge_maglink_lx4_console_firmware*cpe:2.3:o:doverfuelingsolutions:progauge_maglink_lx4_console_firmware:*:*:*:*:*:*:*:*
doverfuelingsolutionsprogauge_maglink_lx4_console-cpe:2.3:h:doverfuelingsolutions:progauge_maglink_lx4_console:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
doverfuelingsolutions	progauge_maglink_lx_console_firmware	*	cpe:2.3:o:doverfuelingsolutions:progauge_maglink_lx_console_firmware::::::::
doverfuelingsolutions	progauge_maglink_lx_console	-	cpe:2.3:h:doverfuelingsolutions:progauge_maglink_lx_console:-:::::::*
doverfuelingsolutions	progauge_maglink_lx4_console_firmware	*	cpe:2.3:o:doverfuelingsolutions:progauge_maglink_lx4_console_firmware::::::::
doverfuelingsolutions	progauge_maglink_lx4_console	-	cpe:2.3:h:doverfuelingsolutions:progauge_maglink_lx4_console:-:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "ProGauge MAGLINK LX CONSOLE",
    "vendor": "Dover Fueling Solutions (DFS)",
    "versions": [
      {
        "lessThanOrEqual": "3.4.2.2.6",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "ProGauge MAGLINK LX4 CONSOLE",
    "vendor": "Dover Fueling Solutions (DFS)",
    "versions": [
      {
        "lessThanOrEqual": "4.17.9e",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/news-events/ics-advisories/icsa-24-268-04

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVSS4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:H/VI:H/SI:H/VA:H/SA:H

AI Score

9.4

Confidence

High

EPSS

Percentile

9.6%

JSON

Related for CVE-2024-45066