What’s Vulnerable › Vulnerabilities

CVE-2025-54807: Dover Fueling Solutions ProGauge MagLink LX 4 Devices Use of Hard-coded Cryptographic Key

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-18 · updated 2026-10-18
• Weakness: CWE-321

Description

The secret used for validating authentication tokens is hardcoded in device firmware for affected versions. An attacker who obtains the signing key can bypass authentication, gaining complete access to the system.

Affected products

• Dover Fueling Solutions ProGauge MagLink LX 4: before 4.20.3 — fixed in 4.20.3
• Dover Fueling Solutions ProGauge MagLink LX Plus: before 4.20.3 — fixed in 4.20.3
• Dover Fueling Solutions ProGauge MagLink LX Ultimate: before 5.20.3 — fixed in 5.20.3

How to fix

Upgrade to a fixed version: Dover Fueling Solutions ProGauge MagLink LX 4 4.20.3; Dover Fueling Solutions ProGauge MagLink LX Plus 4.20.3; Dover Fueling Solutions ProGauge MagLink LX Ultimate 5.20.3. Check the vendor advisory for mitigations.

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-261-07.json
• https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-07
• https://www.doverfuelingsolutions.com/mea/en/products-and-solutions/automatic-tank-gauging/consoles/progauge-maglink-lx-4-console.html

Get alerted when CVE-2025-54807 or the next vulnerability affects your stack