# Dover ProGauge MagLink LX unauthenticated remote control

Published: 2025-06-17 · Severity: routine · Sectors: transportation, retail, infrastructure
Canonical: https://vorant.io/reports/a94eaf41-3e88-53c9-a8c5-e707b3915185/dover-progauge-maglink-lx-unauthenticated-remote-control

> Missing authentication in fuel-tank monitor allows remote code execution and operational control; patch immediately.

Dover Fueling Solutions ProGauge MagLink LX consoles—fuel and water tank monitoring devices deployed worldwide in transportation and retail fuel infrastructure—expose an unauthenticated Target Communication Framework (TCF) interface that permits remote file creation, deletion, and modification. An attacker with network access to the device can achieve remote code execution, manipulate fueling operations, delete system configurations, or deploy malware. The vulnerability (CVE-2025-5310, CVSS 9.8) affects ProGauge MagLink LX 4 and LX Plus versions prior to 4.20.3, and LX Ultimate versions prior to 5.20.3. No public exploitation has been reported. Dover recommends immediate upgrade to patched versions; CISA advises network segmentation, access restrictions, and VPN controls for remote access.

## Mentioned in this report

- Vulnerabilities: CVE-2025-5310

## Detection guidance (public sample)

### Inbound Eclipse TCF Service Connection From Non-Private Source

ATT&CK: T1190

Detects firewall-logged connections from public IP space to TCP port 1534, the default Eclipse Target Communication Framework port, which exposed fuel-tank consoles such as ProGauge MagLink LX (CVE-2025-5310) listen on without authentication. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Inbound Eclipse TCF Service Connection From Non-Private Source
id: dab48288-e2de-51a7-a238-c564bc765129
status: experimental
description: Detects allowed firewall traffic from public address space to TCP port
  1534, the default Target Communication Framework (TCF) port. Unauthenticated TCF
  on ProGauge MagLink LX consoles (CVE-2025-5310) allows remote file creation, deletion
  and modification, leading to code execution. The port is an assumption based on
  the TCF default, so adjust it if the device is configured differently. Internal
  attackers are not covered because private source ranges are excluded.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-168-05
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: firewall
detection:
  selection:
    dst_port: 1534
    action:
    - allow
    - allowed
    - accept
    - permitted
  filter_private_src:
    src_ip|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 127.0.0.0/8
  condition: selection and not filter_private_src
falsepositives:
- Authorised vendor or integrator remote support reaching the console through a published
  NAT address
- Internet scanners or research projects (for example Shodan or Censys) if the firewall
  logs permitted flows
level: medium
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-168-05

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a94eaf41-3e88-53c9-a8c5-e707b3915185/dover-progauge-maglink-lx-unauthenticated-remote-control.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup