External risk intelligence

Dover Fueling Solutions ProGauge MagLink LX4 Default Credentials Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-30519

The device is an automatic tank gauging console used in industrial environments. These devices are often network-connected to facilitate remote monitoring and management of fuel systems. While intended for operational technology environments, they are frequently accessible via network interfaces that can be exposed to wider networks, making internet-reachable deployments a common configuration for such equipment.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical vulnerability in certain fueling system devices that could allow unauthorized administrative access. The issue stems from default credentials that cannot be changed, posing a risk if these devices are accessible over a network. The main concern is confirming relevance and exposure.

Default access credentials are not changeable.
Network access can grant full system control.
Confirm relevance and any network exposure.

Attack Path

How an attacker could exploit the issue

An attacker with network access can leverage the default root credentials on vulnerable devices to gain administrative control. This allows them to access the system and potentially impact its operations.

Network access required.
Default credentials used.
Full administrative access gained.

Live Threat

Current exploitation, exposure, and threat context

With network access, an attacker could gain administrative control over Dover Fueling Solutions ProGauge MagLink LX4 devices. This could potentially affect the configuration and operational data of fuel management systems, as the devices have default root credentials that cannot be changed.

System configuration and operational data.
Via network access with default credentials.
Unauthorized administrative control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The potential for unauthorized administrative access to Dover Fueling Solutions ProGauge MagLink LX4 devices necessitates a focused response. Infrastructure and Operational Technology (OT) teams are likely responsible for managing these devices. The immediate first step is to identify all deployed MagLink LX4 devices, determine their network reachability and business criticality, and confirm the accountable owner for each. Subsequently, a risk-based remediation plan should be developed, potentially involving vendor coordination or temporary mitigating controls, to address the default credential vulnerability.

Identify and map affected devices.
Verify network exposure and criticality.
Plan remediation with vendor support.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Dover Fueling Solutions ProGauge MagLink LX4?

The MagLink LX4 is an automatic tank gauging console. It is designed for industrial environments to monitor fuel levels and management data in storage tanks, often acting as a central hub for fuel inventory systems at service stations or commercial depots.

What does CWE-1391 mean for CVE-2025-30519?

This vulnerability relates to the use of hard-coded, default root credentials that cannot be modified by users. Because these administrative credentials are static and permanent, any system connected to a network is susceptible to unauthorized access, as the password remains the same across all units.

Does local physical access trigger this vulnerability?

While the issue involves administrative credentials, the vulnerability is triggered via network access. An attacker does not need to be at the physical device to gain control; they simply need to be able to communicate with the device over the network using the known default credentials.

How should I interpret Halo Surface Signal for this CVE?

Halo Surface Signal indicates a 'Likely' risk because these consoles are often connected to networks for remote management. If your device is reachable from the internet or a wide, non-segmented network, it is considered exposed, increasing the likelihood of unauthorized administrative access.

What should I do if I manage these devices?

Start by inventorying all deployed units to map their network connections and business importance. Since the credentials cannot be changed, prioritize isolating these consoles from external networks or implementing additional security controls like firewalls or VPNs to restrict access while coordinating with the vendor.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.