Dover Fueling Solutions ProGauge MagLink LX 4 Devices Use of Hard-coded Cryptographic Key
Priority MEDIUM 49CWE-321Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-321.
Summary
The secret used for validating authentication tokens is hardcoded in device firmware for affected versions. An attacker who obtains the signing key can bypass authentication, gaining complete access to the system.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00749 55th percentileScored 2026-11-07
Fix Fixed ProGauge MagLink LX 4 (Dover Fueling Solutions): 4.20.3ProGauge MagLink LX Plus (Dover Fueling Solutions): 4.20.3+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dover Fueling Solutions | ProGauge MagLink LX 4 | before 4.20.3 | 4.20.3 | Patch available | CNA |
| Dover Fueling Solutions | ProGauge MagLink LX Plus | before 4.20.3 | 4.20.3 | Patch available | CNA |
| Dover Fueling Solutions | ProGauge MagLink LX Ultimate | before 5.20.3 | 5.20.3 | Patch available | CNA |
- ProGauge MagLink LX 4 VendorDover Fueling Solutions Affected before 4.20.3 Fixed in 4.20.3 Patch available CNA
- ProGauge MagLink LX Plus VendorDover Fueling Solutions Affected before 4.20.3 Fixed in 4.20.3 Patch available CNA
- ProGauge MagLink LX Ultimate VendorDover Fueling Solutions Affected before 5.20.3 Fixed in 5.20.3 Patch available CNA
Remediation
- Fix · CNA ProGauge MagLink LX 4 (Dover Fueling Solutions) Fixed in 4.20.3
- Fix · CNA ProGauge MagLink LX Plus (Dover Fueling Solutions) Fixed in 4.20.3
- Fix · CNA ProGauge MagLink LX Ultimate (Dover Fueling Solutions) Fixed in 5.20.3
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Dover Fueling Solutions ProGauge MagLink LX 4, ProGauge MagLink LX Plus, ProGauge MagLink LX Ultimate 4.20.3, 5.20.3
3 records Highest priority Priority MEDIUM 3 MEDIUM
Other records, highest priority first
- TI-2025-21794 Dover Fueling Solutions ProGauge MagLink LX4 Devices Use of Weak CredentialsPriority MEDIUM 48
- TI-2025-34758 Dover Fueling Solutions ProGauge MagLink LX4 Devices Integer Overflow or WraparoundPriority MEDIUM 44
Timeline
- 2026-10-02 Threatist record created from CVE-2025-54807
- 2026-10-03 Alias added: GHSA-fmx3-xgw6-w7g2
References
More Dover Fueling Solutions vulnerabilities
- TI-2025-04769 Dover Fueling Solutions ProGauge MagLink LX Consoles Missing Authentication for Critical Function CVSS 4.0CRITICAL 9.3
- TI-2024-30176 Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Command Injection CVSS 4.0CRITICAL 10.0
- TI-2024-29295 Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Command Injection CVSS 4.0CRITICAL 10.0
- TI-2024-29294 Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Authentication Bypass Using an Alternate Path or Channel CVSS 4.0CRITICAL 9.3
- TI-2024-29069 Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Use of Hard-coded Password CVSS 4.0CRITICAL 9.3
- TI-2023-21862 Dover Fueling Solutions MAGLINK LX Console Authentication Bypass CVSS 3.1CRITICAL 9.1
Sources
- CVE-2025-54807 · CVE Program
- CVE-2025-54807 · NVD
- FIRST EPSS
- GHSA-fmx3-xgw6-w7g2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences