CVE-2024-43693 | A specially crafted POST request to the ProGauge MAGLINK LX … | CVSS 10.0 CRITICAL

Description

A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE UTILITY sub-menu can allow a remote attacker to inject arbitrary commands.

CVE ID: CVE-2024-43693
State: PUBLISHED
Assigner: icscert
Reserved: 2024-09-05 20:11 UTC
Published: 2024-09-24 23:50 UTC
Last updated: 2024-09-25 16:55 UTC
Primary CWE: CWE-77
CWE-77 Command Injection
Vendor / Product: Dover Fueling Solutions (DFS) / ProGauge MAGLINK LX CONSOLE
Sources: cve.org · NVD

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Affected products (2)

Vendor	Product	Platform	Versions
Dover Fueling Solutions (DFS)	ProGauge MAGLINK LX CONSOLE	—	0 ≤ 3.4.2.2.6
Dover Fueling Solutions (DFS)	ProGauge MAGLINK LX4 CONSOLE	—	0 ≤ 4.17.9e

Weakness (CWE)

CWE	Source	Description
CWE-77	cna	CWE-77 Command Injection

CVSS scores (2)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
10.0	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References (1)