{"id":"CVE-2023-41256","state":"PUBLISHED","title":"Dover Fueling Solutions MAGLINK LX Console Authentication Bypass","description":"\nDover Fueling Solutions MAGLINK LX Web Console Configuration versions 2.5.1, 2.5.2, 2.5.3, 2.6.1, 2.11, 3.0, 3.2, and 3.3 are vulnerable to authentication bypass that could allow an unauthorized attacker to obtain user access.\n\n","publishedAt":"2023-09-11T18:55:05.231Z","updatedAt":"2025-01-16T21:30:15.820Z","severity":{"score":9.1,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"icscert"},"assigner":"icscert","products":["Dover Fueling Solutions MAGLINK LX Web Console Configuration"],"affected":[{"vendor":"Dover Fueling Solutions","product":"MAGLINK LX Web Console Configuration","defaultStatus":"unaffected","versions":[{"version":"2.5.1","status":"affected"},{"version":"2.5.2","status":"affected"},{"version":"2.5.3","status":"affected"},{"version":"2.6.1","status":"affected"},{"version":"2.11","status":"affected"},{"version":"3.0","status":"affected"},{"version":"3.2","status":"affected"},{"version":"3.3","status":"affected"}]}],"references":["https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-01"],"weaknesses":["CWE-288"],"ingestedAt":"2026-10-29T20:06:17.512Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/41xxx/CVE-2023-41256.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-41256","state":"PUBLISHED","datePublished":"2023-09-11T18:55:05.231Z","dateUpdated":"2025-01-16T21:30:15.820Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2023-09-01T20:57:37.402Z"},"containers":{"cna":{"title":"Dover Fueling Solutions MAGLINK LX Console Authentication Bypass","descriptions":[{"lang":"en","value":"\nDover Fueling Solutions MAGLINK LX Web Console Configuration versions 2.5.1, 2.5.2, 2.5.3, 2.6.1, 2.11, 3.0, 3.2, and 3.3 are vulnerable to authentication bypass that could allow an unauthorized attacker to obtain user access.\n\n"}],"affected":[{"vendor":"Dover Fueling Solutions","product":"MAGLINK LX Web Console Configuration","defaultStatus":"unaffected","versions":[{"version":"2.5.1","status":"affected"},{"version":"2.5.2","status":"affected"},{"version":"2.5.3","status":"affected"},{"version":"2.6.1","status":"affected"},{"version":"2.11","status":"affected"},{"version":"3.0","status":"affected"},{"version":"3.2","status":"affected"},{"version":"3.3","status":"affected"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-01"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-288","description":"CWE-288 Authentication Bypass Using an Alternate Path or Channel","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2023-09-11T18:55:05.231Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Soufian El Yadmani of Darktrace / CSIRT.global reported these vulnerabilities"}],"datePublic":"2023-09-07T17:43:00.000Z","solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"\n\n<span style=\"background-color: rgb(255, 255, 255);\">In 2023, Dover Fueling Solutions announced end-of-life for MAGLINK LX 3 and released MAGLINK LX 4. However, MAGLINK LX 3 version 3.4.2.2.6 and MAGLINK LX 4 fixes these vulnerabilities.</span>\n\n<br>"}],"value":"\nIn 2023, Dover Fueling Solutions announced end-of-life for MAGLINK LX 3 and released MAGLINK LX 4. However, MAGLINK LX 3 version 3.4.2.2.6 and MAGLINK LX 4 fixes these vulnerabilities.\n\n\n"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-01","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T18:54:04.641Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-01-16T21:22:59.719159Z","id":"CVE-2023-41256","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-01-16T21:30:15.820Z"}}]}}}