CISA Alerts on Critical Veeder-Root Flaws Allowing Attackers to Execute System Commands

According to CISA, the agency has issued a critical security alert released on 23 October 2025 about serious vulnerabilities in Veeder-Root’s TLS4B Automatic Tank Gauge System.

Two critical flaws were identified, with security researchers at Bitsight crediting the discovery; the first vulnerability — CVE-2025-58428, described as Command Injection (CWE-77) — could allow remote attackers to execute system-level commands on the underlying Linux system, potentially giving them full shell access and the ability to move around the network, and it has been assigned an exceptionally high CVSS score of 9.4 out of 10.

The second vulnerability — CVE-2025-55067, an Integer Overflow/Wraparound (CWE-190) issue — could enable authentication failures and denial of service via time value manipulation, with the system clock affecting dates from January 19, 2038 to December 13, 1901, and a permanent fix is still in development.

Veeder-Root states that all versions prior to Version 11.A are vulnerable to the command injection flaw, and Version 11.A has been released to address CVE-2025-58428, while organisations are urged to follow network security best practices until a fix for CVE-2025-55067 is available. CISA advises minimising internet exposure for all control system devices, isolating them behind firewalls, and using VPNs with current updates when remote access is necessary.