CVE-2025-58428: TLS4B ATG System RCE Vulnerability

CVE-2025-58428 Overview

CVE-2025-58428 is a critical command injection vulnerability affecting the TLS4B ATG system's SOAP-based interface. The vulnerability exists due to the interface's accessibility through the web services handler, which fails to properly sanitize user-supplied input before passing it to system-level commands. This flaw enables remote attackers with valid credentials to execute arbitrary system-level commands on the underlying Linux operating system.

The impact of successful exploitation is severe, potentially allowing attackers to achieve remote command execution, gain full shell access to the affected system, and leverage this foothold for lateral movement within the operational technology (OT) network. Given that ATG (Automatic Tank Gauge) systems are commonly deployed in critical infrastructure environments such as fuel storage and distribution facilities, this vulnerability poses significant risks to industrial control systems.

Critical Impact

Remote attackers with valid credentials can execute system-level commands on the underlying Linux system, enabling full shell access and potential lateral movement within the network.

Affected Products

• TLS4B ATG System (SOAP-based web services interface)
• Veeder-Root TLS systems with vulnerable firmware versions
• Industrial control systems utilizing the affected SOAP handler

Discovery Timeline

• October 23, 2025 - CVE-2025-58428 published to NVD
• October 27, 2025 - Last updated in NVD database

Technical Details for CVE-2025-58428

Vulnerability Analysis

This vulnerability is classified as CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'). The TLS4B ATG system exposes a SOAP-based web services interface that processes user requests without adequate input validation. When authenticated users submit specially crafted SOAP requests, the application fails to properly sanitize command parameters before executing them on the underlying Linux operating system.

The network-accessible nature of this vulnerability significantly increases its risk profile. Attackers can exploit this flaw remotely without requiring physical access to the device, though valid credentials are necessary for successful exploitation. Once authenticated, an attacker can inject malicious commands that execute with the privileges of the web services process, potentially running as root or with elevated permissions on the embedded Linux system.

Root Cause

The root cause of CVE-2025-58428 lies in insufficient input validation within the SOAP request handler. The web services interface accepts user-controlled parameters and passes them directly to system commands without proper sanitization or parameterization. This allows special shell characters and command separators to be interpreted by the underlying shell, enabling command injection attacks.

The vulnerability is compounded by the architectural decision to expose the SOAP interface through the web services handler without implementing adequate security controls such as input whitelisting, command parameterization, or sandboxed execution environments.

Attack Vector

The attack vector for this vulnerability involves sending specially crafted SOAP requests to the TLS4B ATG system's web services endpoint. An attacker must first obtain valid credentials, either through credential theft, brute force attacks, or by exploiting default credentials that may be present on the system.

Once authenticated, the attacker constructs SOAP requests containing malicious payloads within parameters that are subsequently passed to system commands. The injected commands execute on the underlying Linux system, allowing the attacker to read sensitive files, modify system configurations, establish persistent backdoors, or pivot to other systems on the network.

For detailed technical information about this vulnerability, refer to the CISA ICS Advisory ICSA-25-296-03 and the GitHub CSAF JSON File.

Detection Methods for CVE-2025-58428

Indicators of Compromise

• Unusual SOAP requests containing shell metacharacters such as ;, |, &, $(), or backticks in request parameters
• Unexpected processes spawned by the web services handler on ATG systems
• Anomalous outbound network connections from ATG devices to external IP addresses
• Evidence of command execution logs showing unauthorized system commands

Detection Strategies

• Deploy network intrusion detection systems (NIDS) with signatures for command injection patterns in SOAP traffic destined for ATG systems
• Monitor authentication logs for failed login attempts followed by successful authentication to detect credential-based attacks
• Implement application-layer firewalls capable of inspecting SOAP requests for malicious payloads
• Configure SIEM rules to alert on command injection patterns within web services traffic

Monitoring Recommendations

• Enable verbose logging on TLS4B ATG systems to capture all SOAP requests and system command execution
• Establish baseline network behavior for ATG systems and alert on deviations indicating potential exploitation
• Monitor process trees on ATG systems for child processes spawned by web services components
• Implement file integrity monitoring on critical system files and configurations

How to Mitigate CVE-2025-58428

Immediate Actions Required

• Restrict network access to TLS4B ATG systems using network segmentation and firewall rules to limit exposure
• Change all default credentials on ATG systems and implement strong password policies
• Review and audit user accounts with access to the SOAP interface, removing unnecessary access
• Isolate affected ATG systems from general IT networks pending patch deployment

Patch Information

Veeder-Root has released security updates to address this vulnerability. Administrators should download the latest firmware from the Veeder Software Downloads portal. Prior to applying updates, review the Veeder Network Security Reminder for additional hardening recommendations and best practices for securing ATG systems.

Organizations should prioritize patching based on the critical severity of this vulnerability and the potential impact on operational technology environments. Testing patches in a staging environment before production deployment is recommended.

Workarounds

• Implement strict network segmentation to isolate ATG systems from untrusted networks and the internet
• Deploy a web application firewall (WAF) in front of the SOAP interface to filter malicious requests
• Disable the SOAP-based web services interface if not operationally required until patches can be applied
• Implement multi-factor authentication for access to the ATG management interface where supported

# Network segmentation example using iptables
# Restrict SOAP interface access to authorized management IPs only
iptables -A INPUT -p tcp --dport 80 -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP