Loading story…
A critical command injection vulnerability, tracked as CVE-2025-58428, has been identified in the Veeder-Root TLS4B Automatic Tank Gauge (ATG) System. The flaw resides in the system's SOAP-based web services interface, which allows remote attackers with valid credentials to execute arbitrary system-level commands on the underlying Linux operating system. Successful exploitation could grant attackers full shell access, enable remote command execution, and facilitate lateral movement within affected networks, posing a significant risk to organizations relying on these systems for fuel management and monitoring.
Security advisories highlight that all versions of the TLS4B system prior to 11.A are affected. In addition to the command injection issue, the system is also vulnerable to an integer overflow related to Unix time handling, which could cause system resets after the 2038 epoch rollover. The vulnerabilities are rated as critical, with CVSS scores of 9.9 (v3.1) and 9.4 (v4), and could result in denial of service, administrative lockout, or disruption of core functionalities if exploited. Organizations are urged to review vendor guidance and apply mitigations to protect against these threats.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
CISA issued advisory ICSA-25-296-03 covering the two vulnerabilities affecting Veeder-Root TLS4B Automatic Tank Gauge Systems used in the energy sector worldwide. CISA also recommended minimizing internet exposure, segmenting control system networks, and using secure remote access methods, and said it had no reports of public exploitation at publication time.
Veeder-Root recommended that customers upgrade affected TLS4B Automatic Tank Gauge Systems to version 11.A to remediate the command injection vulnerability. For the time-handling flaw, customers were advised to apply network security best practices pending a vendor fix.
Veeder-Root disclosed CVE-2025-55067, an integer overflow issue tied to Unix time handling in TLS4B systems that can reset the clock to 1901. The bug may cause authentication failures, administrative lockout, corrupted logs, and denial of service, and no fix was yet available at the time of publication.
Veeder-Root identified CVE-2025-58428, a command injection vulnerability in the SOAP-based web services interface of TLS4B Automatic Tank Gauge Systems before version 11.A. The flaw could allow a remote attacker with valid credentials to execute system-level commands, obtain full shell access, and potentially move laterally on the network.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dell disclosed **CVE-2026-67261**, a critical OS command injection flaw in **Dell Virtual Storage Integrator (VSI) for VMware vSphere Client** that affects versions prior to **10.11.1.0**. The vulnerability is located in the **IAPI** component and can be exploited **remotely without authentication**, allowing an attacker to execute arbitrary operating system commands with **root privileges**. The issue is tracked as **CWE-78** and carries a **CVSS v3.1** vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating a high likelihood of full compromise. Dell warned that successful exploitation could lead to complete takeover of the VSI deployment and potentially expose underlying infrastructure managed through the platform. A related advisory from **CERT-PY** highlighted the vulnerability in Dell products, reinforcing the need for defensive action. Dell has recommended that customers **upgrade to version 10.11.1.0 or later as soon as possible** to remediate the risk.
Aug 16, 2026
AVEVA disclosed a critical deserialization of untrusted data vulnerability in **Enterprise SCADA** tracked as `CVE-2025-7639`, a remotely exploitable flaw with a **CVSS 4.0 score of 10.0**. The issue allows an authenticated attacker holding the **"DNA Authority - Operator"** privilege to tamper with serialized data and potentially trigger code execution during deserialization under the privileges of the **"DNA Apps"** security group. The vendor addressed the issue in security bulletin **`AVEVA-2026-005`** and advised organizations to apply available patches and hardening measures. Recommended mitigations include restricting operator privileges and validating serialized data inputs, as the flaw affects industrial control and supervisory environments where compromise of SCADA application privileges could materially increase operational risk.
Aug 14, 2026Multiple critical vulnerabilities have been identified in Dover Fueling Solutions ProGauge MagLink LX4 devices, including integer overflow, use of hard-coded cryptographic keys, and weak credentials. These flaws could allow remote attackers to cause denial-of-service or gain administrative access. No public exploitation has been reported, but immediate mitigation is advised.
Jun 29, 2026