No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
Credit: Pedro Umbelino (Bitsight TRACE)
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2025-30519 | CWE-1391 Use of Weak Credentials | 9.8 Critical |
Affected versions of the device have default root credentials that cannot be changed through standard administrative means. An attacker with network access to the device can gain administrative access to the system. Mitigation: Dover Fueling Solutions recommends users update their ProGauge MagLink devices to Version 4.20.3 or later for MagLink LX 4 and MagLink LX Plus models. The upgrade can be downloaded from the Dover Fueling Solutions website. ↗ Mitigation: For MagLink LX Ultimate devices, Dover Fueling Solutions recommends users update to version 5.20.3 or later. ↗ Mitigation: Dover Fueling Solutions recommends all users install the software behind a firewall to minimize risk of remote attacks. Affected, fixed & timelineAffected:
|
| CVE-2025-54807 | CWE-321 Use of Hard-coded Cryptographic Key | 9.8 Critical |
The secret used for validating authentication tokens is hardcoded in device firmware for affected versions. An attacker who obtains the signing key can bypass authentication, gaining complete access to the system. Mitigation: Dover Fueling Solutions recommends users update their ProGauge MagLink devices to Version 4.20.3 or later for MagLink LX 4 and MagLink LX Plus models. The upgrade can be downloaded from the Dover Fueling Solutions website. ↗ Mitigation: For MagLink LX Ultimate devices, Dover Fueling Solutions recommends users update to version 5.20.3 or later. ↗ Mitigation: Dover Fueling Solutions recommends all users install the software behind a firewall to minimize risk of remote attacks. Affected, fixed & timelineAffected:
|
| CVE-2025-55068 | CWE-190 Integer Overflow or Wraparound | 8.2 High |
Affected devices fail to handle Unix time values beyond a certain point. An attacker can manually change the system time to exploit this limitation, potentially causing errors in authentication and leading to a denial of service condition. Mitigation: Dover Fueling Solutions recommends users update their ProGauge MagLink devices to Version 4.20.3 or later for MagLink LX 4 and MagLink LX Plus models. The upgrade can be downloaded from the Dover Fueling Solutions website. ↗ Mitigation: For MagLink LX Ultimate devices, Dover Fueling Solutions recommends users update to version 5.20.3 or later. ↗ Mitigation: Dover Fueling Solutions recommends all users install the software behind a firewall to minimize risk of remote attacks. Affected, fixed & timelineAffected:
|
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2025-30519 | 9.8 Critical | Dover Fueling Solutions ProGauge MagLink LX 4 Dover Fueling Solutions ProGauge MagLink LX4 Devices have default root credentials that cannot be changed through standard administrative means. An … |
| CVE-2025-54807 | 9.8 Critical | Dover Fueling Solutions ProGauge MagLink LX 4 The secret used for validating authentication tokens is hardcoded in device firmware for affected versions. An attacker who obtains the signing key… |
| CVE-2025-55068 | 8.2 High | Dover Fueling Solutions ProGauge MagLink LX 4 Dover Fueling Solutions ProGauge MagLink LX4 Devices fail to handle Unix time values beyond a certain point. An attacker can manually change the sys… |
Named by the advisory itself. Each CVE links to its tracked detail page.
No KEV-catalogued vendors are named in this publication.