CVE-2024-45066: ProGauge MAGLINK LX Console RCE Flaw

CVE-2024-45066 Overview

CVE-2024-45066 is a critical command injection vulnerability affecting the Dover Fueling Solutions ProGauge MAGLINK LX and LX4 Console firmware. A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE IP sub-menu can allow a remote attacker to inject arbitrary commands on the affected device. This vulnerability represents a severe security risk to critical infrastructure environments, particularly gas stations and fuel distribution facilities that rely on these tank monitoring systems.

Critical Impact

This vulnerability allows unauthenticated remote attackers to execute arbitrary commands on fuel tank monitoring systems, potentially compromising critical infrastructure operations, enabling data theft, or causing physical safety hazards through manipulation of fuel monitoring data.

Affected Products

• Dover Fueling Solutions ProGauge MAGLINK LX Console Firmware (all versions)
• Dover Fueling Solutions ProGauge MAGLINK LX Console Hardware
• Dover Fueling Solutions ProGauge MAGLINK LX4 Console Firmware (all versions)
• Dover Fueling Solutions ProGauge MAGLINK LX4 Console Hardware

Discovery Timeline

• 2024-09-25 - CVE-2024-45066 published to NVD
• 2024-10-01 - Last updated in NVD database

Technical Details for CVE-2024-45066

Vulnerability Analysis

CVE-2024-45066 is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command - Command Injection). The vulnerability exists within the web-based management interface of the ProGauge MAGLINK LX Console, specifically in the IP sub-menu functionality. When processing POST requests to the IP configuration endpoint, the application fails to properly sanitize user-supplied input before passing it to system-level command execution functions.

The ProGauge MAGLINK LX Console is an automatic tank gauge (ATG) system used extensively in fuel retail and distribution environments for monitoring fuel levels, detecting leaks, and managing inventory. These systems are often deployed in environments where network segmentation may be insufficient, making them attractive targets for adversaries seeking to compromise industrial control systems (ICS) or operational technology (OT) networks.

Root Cause

The root cause of this vulnerability is improper input validation in the IP configuration sub-menu handler. User-supplied data from POST request parameters is concatenated directly into system commands without proper sanitization or parameterization. This allows attackers to break out of the intended command context by injecting shell metacharacters such as semicolons, pipes, or backticks, followed by arbitrary commands.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker with network access to the vulnerable device's web interface can craft malicious POST requests targeting the IP sub-menu endpoint. By embedding shell metacharacters and malicious commands within POST parameters, the attacker can achieve arbitrary command execution with the privileges of the web application process.

The attack can be launched remotely from anywhere on the network where the ProGauge console's web interface is accessible. Given that these devices are often deployed with default configurations and may be exposed to broader networks than intended, the attack surface can be significant.

Since this is an ICS/OT device, successful exploitation could enable attackers to manipulate fuel level readings, disable leak detection alarms, access sensitive operational data, or use the compromised device as a pivot point for lateral movement within the facility's network infrastructure.

Detection Methods for CVE-2024-45066

Indicators of Compromise

• Unusual POST requests to the IP configuration sub-menu containing shell metacharacters (;, |, &, backticks, $())
• Unexpected outbound network connections from ProGauge MAGLINK devices
• Anomalous process execution or new processes spawned by the web server component
• Unauthorized configuration changes to IP settings or network parameters
• Log entries showing failed or suspicious authentication attempts followed by successful command execution

Detection Strategies

• Implement network intrusion detection rules to identify POST requests to the IP sub-menu containing command injection payloads
• Deploy application-layer firewalls or web application firewalls (WAF) to inspect and block malicious requests to ProGauge devices
• Monitor system logs on ProGauge consoles for unexpected command execution or error messages indicating injection attempts
• Establish baseline network traffic patterns for ATG devices and alert on deviations

Monitoring Recommendations

• Enable comprehensive logging on the ProGauge MAGLINK Console and forward logs to a centralized SIEM for analysis
• Implement network traffic monitoring for all communications to and from fuel monitoring systems
• Deploy host-based monitoring agents where possible to detect unauthorized process execution
• Conduct regular vulnerability scans of OT/ICS environments to identify exposed management interfaces

How to Mitigate CVE-2024-45066

Immediate Actions Required

• Isolate affected ProGauge MAGLINK LX and LX4 consoles from untrusted networks immediately
• Implement strict network segmentation to limit access to the web management interface to authorized administrative systems only
• Deploy firewall rules to block external access to the device's management ports
• Review access logs for any signs of exploitation attempts
• Contact Dover Fueling Solutions for firmware update availability and guidance

Patch Information

Organizations should consult the CISA ICS Advisory ICSA-24-268-04 for detailed remediation guidance and contact Dover Fueling Solutions directly for information on available firmware updates that address this vulnerability.

Workarounds

• Place ProGauge MAGLINK consoles behind a firewall and restrict access to the web interface to trusted IP addresses only
• Implement VPN or jump server requirements for all remote administrative access to ATG systems
• Disable or restrict access to the web management interface if not operationally required
• Deploy a reverse proxy with input validation capabilities in front of the device's web interface
• Implement network monitoring to detect and alert on suspicious traffic patterns targeting fuel monitoring systems

# Example firewall rules to restrict access to ProGauge management interface
# Allow only authorized management workstations
iptables -A INPUT -p tcp --dport 80 -s 10.0.1.100 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.0.1.100 -j ACCEPT
# Block all other access to web interface
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP