ByteOS Network

Vulnerability Details :

CVE-2023-36497

Assigner Org ID-7d14cffa-0d7d-4270-9dc0-52cabd5a23a6

Published At-11 Sep, 2023 | 19:36

Updated At-16 Jan, 2025 | 21:29

Dover Fueling Solutions MAGLINK LX Web Console Authentication Bypass by Primary Weakness

Dover Fueling Solutions MAGLINK LX Web Console Configuration versions 2.5.1, 2.5.2, 2.5.3, 2.6.1, 2.11, 3.0, 3.2, and 3.3 could allow a guest user to elevate to admin privileges.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:icscert

Assigner Org ID:7d14cffa-0d7d-4270-9dc0-52cabd5a23a6

Published At:11 Sep, 2023 | 19:36

Updated At:16 Jan, 2025 | 21:29

▼CVE Numbering Authority (CNA)

Dover Fueling Solutions MAGLINK LX Web Console Authentication Bypass by Primary Weakness

Dover Fueling Solutions MAGLINK LX Web Console Configuration versions 2.5.1, 2.5.2, 2.5.3, 2.6.1, 2.11, 3.0, 3.2, and 3.3 could allow a guest user to elevate to admin privileges.

Affected Products

Vendor

Dover Fueling Solutions

Product

MAGLINK LX Web Console Configuration

Default Status

unaffected

Versions

Affected

2.5.1
2.5.2
2.5.3
2.6.1
2.11
3.0
3.2
3.3

Problem Types

Type	CWE ID	Description
CWE	CWE-305	CWE-305: Authentication Bypass by Primary Weakness

Type: CWE

CWE ID: CWE-305

Description: CWE-305: Authentication Bypass by Primary Weakness

Metrics

Version	Base score	Base severity	Vector
3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Version: 3.1

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Solutions

In 2023, Dover Fueling Solutions announced end-of-life for MAGLINK LX 3 and released MAGLINK LX 4. However, MAGLINK LX 3 version 3.4.2.2.6 and MAGLINK LX 4 fixes these vulnerabilities.

Credits

finder

Soufian El Yadmani of Darktrace / CSIRT.global reported these vulnerabilities

References

Hyperlink	Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-01	N/A

Hyperlink: https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-01

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-01	x_transferred

Hyperlink: https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-01

Resource:

x_transferred

2. CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:ics-cert@hq.dhs.gov

Published At:11 Sep, 2023 | 20:15

Updated At:24 Oct, 2024 | 17:15

Dover Fueling Solutions MAGLINK LX Web Console Configuration versions 2.5.1, 2.5.2, 2.5.3, 2.6.1, 2.11, 3.0, 3.2, and 3.3 could allow a guest user to elevate to admin privileges.