CISA Warns of Critical Vulnerabilities in Dover Fueling Solutions’ ProGauge MagLink LX

CISA has warned of multiple critical vulnerabilities in Dover Fueling Solutions’ ProGauge MagLink LX devices, widely used in fuel stations and industrial environments, with a potential for denial-of-service or unauthorised administrative access. The first flaw, CVE-2025-55068 (CVSS 8.2), stems from improper handling of Unix time values and could let an attacker disrupt authentication and trigger outages by manipulating system time, according to CISA.

A second vulnerability, CVE-2025-54807 (CVSS 9.8), involves a hard-coded secret in device firmware that could allow an attacker with the signing key to bypass authentication and gain full system access, according to the advisory. A third issue, CVE-2025-30519 (CVSS 9.8), concerns default, non-changeable root credentials that enable unauthorised administrative access if the device is reachable on the network, according to the advisory.

Dover has released updates addressing these flaws for MagLink LX 4 and LX Plus to version 4.20.3 and MagLink LX Ultimate to version 5.20.3, and it also recommends placing devices behind a firewall and minimising network exposure.