Dover ProGauge MagLink LX unauthenticated remote control
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Missing authentication in fuel-tank monitor allows remote code execution and operational control; patch immediately.
Dover Fueling Solutions ProGauge MagLink LX consoles—fuel and water tank monitoring devices deployed worldwide in transportation and retail fuel infrastructure—expose an unauthenticated Target Communication Framework (TCF) interface that permits remote file creation, deletion, and modification. An attacker with network access to the device can achieve remote code execution, manipulate fueling operations, delete system configurations, or deploy malware. The vulnerability (CVE-2025-5310, CVSS 9.8) affects ProGauge MagLink LX 4 and LX Plus versions prior to 4.20.3, and LX Ultimate versions prior to 5.20.3. No public exploitation has been reported. Dover recommends immediate upgrade to patched versions; CISA advises network segmentation, access restrictions, and VPN controls for remote access.
Mentioned in this report
Detection guidance
Inbound Eclipse TCF Service Connection From Non-Private Source
Detects firewall-logged connections from public IP space to TCP port 1534, the default Eclipse Target Communication Framework port, which exposed fuel-tank consoles such as ProGauge MagLink LX (CVE-2025-5310) listen on without authentication. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Inbound Eclipse TCF Service Connection From Non-Private Source
id: dab48288-e2de-51a7-a238-c564bc765129
status: experimental
description: Detects allowed firewall traffic from public address space to TCP port
1534, the default Target Communication Framework (TCF) port. Unauthenticated TCF
on ProGauge MagLink LX consoles (CVE-2025-5310) allows remote file creation, deletion
and modification, leading to code execution. The port is an assumption based on
the TCF default, so adjust it if the device is configured differently. Internal
attackers are not covered because private source ranges are excluded.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-168-05
tags:
- attack.initial-access
- attack.t1190
logsource:
category: firewall
detection:
selection:
dst_port: 1534
action:
- allow
- allowed
- accept
- permitted
filter_private_src:
src_ip|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
condition: selection and not filter_private_src
falsepositives:
- Authorised vendor or integrator remote support reaching the console through a published
NAT address
- Internet scanners or research projects (for example Shodan or Censys) if the firewall
logs permitted flows
level: medium
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-168-05
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs