CVE-2024-43693: ProGauge MAGLINK LX Console RCE Flaw

CVE-2024-43693 Overview

CVE-2024-43693 is a critical command injection vulnerability affecting Dover Fueling Solutions ProGauge MAGLINK LX and LX4 Console devices. A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE UTILITY sub-menu can allow a remote attacker to inject arbitrary commands on the underlying system. This vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command), indicating that the affected firmware fails to properly sanitize user-supplied input before passing it to system command execution functions.

Critical Impact

This vulnerability allows unauthenticated remote attackers to execute arbitrary commands on industrial fuel management systems, potentially compromising critical infrastructure operations, fuel inventory management, and safety monitoring systems.

Affected Products

• Dover Fueling Solutions ProGauge MAGLINK LX Console Firmware
• Dover Fueling Solutions ProGauge MAGLINK LX Console Hardware
• Dover Fueling Solutions ProGauge MAGLINK LX4 Console Firmware
• Dover Fueling Solutions ProGauge MAGLINK LX4 Console Hardware

Discovery Timeline

• 2024-09-25 - CVE-2024-43693 published to NVD
• 2024-10-01 - Last updated in NVD database

Technical Details for CVE-2024-43693

Vulnerability Analysis

This command injection vulnerability exists within the UTILITY sub-menu functionality of the ProGauge MAGLINK LX Console web interface. The device's firmware does not adequately validate or sanitize input data received via HTTP POST requests before incorporating it into system-level commands. When exploited, this allows an attacker to break out of the intended command context and inject additional shell commands that execute with the privileges of the web application process.

ProGauge MAGLINK systems are deployed in fuel station environments to monitor tank levels, detect leaks, and manage inventory. Successful exploitation of this vulnerability could grant attackers full control over these critical systems, potentially affecting fuel dispensing operations, safety monitoring functions, and environmental compliance reporting.

Root Cause

The root cause of CVE-2024-43693 is improper input validation in the web interface's UTILITY sub-menu handler. User-supplied data from POST request parameters is passed directly to command execution functions without proper sanitization or escaping of shell metacharacters. This allows attackers to inject arbitrary commands by including shell command separators (such as semicolons, pipes, or backticks) in their input, which the system then interprets and executes.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker with network access to the MAGLINK LX Console's web interface can craft a malicious HTTP POST request targeting the vulnerable UTILITY sub-menu endpoint. The injected commands execute on the underlying operating system, potentially allowing the attacker to:

• Execute arbitrary system commands with elevated privileges
• Modify device configuration and firmware settings
• Exfiltrate sensitive operational data including fuel inventory records
• Establish persistent access through backdoor installation
• Pivot to other systems on the network
• Disrupt fuel monitoring and safety functions

Due to the ICS/SCADA nature of these devices, successful exploitation could have significant impacts on fuel station operations and safety systems. The vulnerability requires no special conditions for exploitation beyond network reachability, making it highly exploitable in environments where the device is exposed to untrusted networks.

Detection Methods for CVE-2024-43693

Indicators of Compromise

• Unusual HTTP POST requests to the UTILITY sub-menu endpoints containing shell metacharacters (;, |, &, $(), or backticks)
• Unexpected process execution or network connections originating from the MAGLINK console device
• Modifications to system files or configuration outside of normal administrative activity
• Presence of unauthorized user accounts or SSH keys on the device
• Anomalous outbound connections to external IP addresses from the console

Detection Strategies

• Deploy network intrusion detection systems (IDS) with signatures targeting command injection patterns in HTTP POST requests to MAGLINK devices
• Implement web application firewall (WAF) rules to filter requests containing shell metacharacters to the affected endpoints
• Monitor network traffic for unusual communication patterns to/from ProGauge MAGLINK consoles
• Enable and review access logs on MAGLINK devices for suspicious POST request activity

Monitoring Recommendations

• Segment MAGLINK LX Console devices on isolated ICS/SCADA network segments with restricted access
• Implement continuous monitoring of network traffic between IT and OT networks where these devices reside
• Establish baseline behavior for MAGLINK device communications and alert on deviations
• Review CISA ICS advisory ICSA-24-268-04 for additional monitoring guidance specific to this vulnerability

How to Mitigate CVE-2024-43693

Immediate Actions Required

• Immediately restrict network access to affected ProGauge MAGLINK LX and LX4 Console devices using firewall rules or network segmentation
• Ensure these devices are not accessible from the internet or untrusted networks
• Implement VPN access requirements for any remote administration needs
• Contact Dover Fueling Solutions for firmware update availability and apply patches immediately when available
• Review device logs for any indicators of prior exploitation attempts

Patch Information

Organizations should consult the CISA ICS Advisory ICSA-24-268-04 for the latest patch information and remediation guidance from Dover Fueling Solutions. Given the critical nature of this vulnerability, patch application should be prioritized. Contact Dover Fueling Solutions support directly for firmware updates that address CVE-2024-43693.

Workarounds

• Implement strict network segmentation to isolate MAGLINK devices from corporate networks and the internet
• Deploy a web application firewall (WAF) or reverse proxy configured to filter malicious input patterns
• Disable remote access to the UTILITY sub-menu if not operationally required
• Implement IP-based access control lists limiting connections to trusted management workstations only
• Monitor and log all HTTP traffic to MAGLINK consoles for forensic analysis

# Example network segmentation using iptables
# Restrict MAGLINK console access to authorized management subnet only
iptables -A INPUT -s 10.0.100.0/24 -d <MAGLINK_IP> -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -s 10.0.100.0/24 -d <MAGLINK_IP> -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -d <MAGLINK_IP> -p tcp --dport 80 -j DROP
iptables -A INPUT -d <MAGLINK_IP> -p tcp --dport 443 -j DROP