CISA Warns: Critical Veeder-Root TLS4B RCE (CVE-2025-58428) Exposes Tank Gauge Systems to Command Injection

According to The Cybersecurity and Infrastructure Security Agency (CISA), two high-severity vulnerabilities affect the Veeder-Root TLS4B Automatic Tank Gauge (ATG) System, potentially allowing remote attackers to gain command execution and disrupt critical operations.

The most severe flaw, CVE-2025-58428, is a command injection vulnerability impacting TLS4B versions prior to 11.A, with a CVSS v3.1 base score of 9.9, and it arises from the SOAP-based interface being accessible through the web services handler, enabling authenticated attackers to execute system-level commands and gain full shell access.

A second vulnerability, CVE-2025-55067, rated 7.1 (High), concerns an integer overflow related to handling of Unix time values approaching the 2038 epoch rollover, which could cause DoS and administrative lockout if exploited by clock manipulation. The advisory notes that Veeder-Root has released an update for CVE-2025-58428 recommending upgrading to Version 11.A, while no patch is yet available for CVE-2025-55067, with the vendor advising network segmentation and defensive measures in the meantime. The alert was issued on 27 October 2025.