CVE-2025-5310

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Dover Fueling Solutions ProGauge MagLink LX Consoles expose an undocumented and unauthenticated target communication framework (TCF) interface on a specific port. Files can be created, deleted, or modified, potentially leading to remote code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
Dover Fueling Solutions	ProGauge MagLink LX 4	< 4.20.3
Dover Fueling Solutions	ProGauge MagLink LX Plus	< 4.20.3
Dover Fueling Solutions	ProGauge MagLink LX Ultimate	< 5.20.3

References

Timeline

Published: Jun 27, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-531008.6RestDB's Codehooks.io MCP Server is an MCP server on the Codehooks.io platform. Prior to version 0.2.2, the MCP server is written in a way t CVE-2025-531019.8ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, i CVE-2025-531029.8Discourse is an open-source community discussion platform. Prior to version 3.4.7 on the `stable` branch and version 3.5.0.beta.8 on the `te CVE-2025-531035.8JUnit is a testing framework for Java and the JVM. From version 5.12.0 to 5.13.1, JUnit's support for writing Open Test Reporting XML files CVE-2025-531049.1gluestack-ui is a library of copy-pasteable components & patterns crafted with Tailwind CSS (NativeWind). Prior to commit e6b4271, a command CVE-2025-531057.5GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Servi CVE-2025-531068.8Graylog is a free and open log management platform. In versions 6.2.0 to before 6.2.4 and 6.3.0-alpha.1 to before 6.3.0-rc.2, Graylog users CVE-2025-531077.5@cyanheads/git-mcp-server is an MCP server designed to interact with Git repositories. Prior to version 2.1.5, there is a command injection CVE-2025-531085.3HomeBox is a home inventory and organization system. Prior to 0.20.1, HomeBox contains a missing authorization check in the API endpoints re CVE-2025-531097.3Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). Versions of Filesystem pri CVE-2025-531107.3Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). Versions of Filesystem pri CVE-2025-531116.5GLPI is a Free Asset and IT Management Software package. In versions 0.80 through 10.0.18, a lack of permission checks can result in unautho