{"id":"CVE-2025-55067","state":"PUBLISHED","title":"Integer Overflow or Wraparound in Veeder-Root TLS4B Automatic Tank Gauge System","description":"The TLS4B ATG system is vulnerable to improper handling of Unix time values that exceed the 2038 epoch rollover. When the system clock reaches January 19, 2038, it resets to December 13, 1901, causing authentication failures and disrupting core system functionalities such as login access, history visibility, and leak detection termination. This vulnerability could allow an attacker to manipulate the system time to trigger a denial of service (DoS) condition, leading to administrative lockout, operational timer failures, and corrupted log entries.","publishedAt":"2025-10-23T19:39:14.879Z","updatedAt":"2025-10-23T20:30:20.323Z","severity":{"score":7.1,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","source":"icscert"},"assigner":"icscert","products":["Veeder-Root TLS4B Automatic Tank Gauge System"],"affected":[{"vendor":"Veeder-Root","product":"TLS4B Automatic Tank Gauge System","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"11.A","versionType":"custom"}]}],"references":["https://www.cisa.gov/news-events/ics-advisories/icsa-25-296-03","https://www.veeder.com/us/network-security-reminder","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-03.json"],"weaknesses":["CWE-190"],"ingestedAt":"2026-10-29T20:09:31.862Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/55xxx/CVE-2025-55067.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-55067","state":"PUBLISHED","datePublished":"2025-10-23T19:39:14.879Z","dateUpdated":"2025-10-23T20:30:20.323Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2025-09-23T19:56:48.001Z"},"containers":{"cna":{"title":"Integer Overflow or Wraparound in Veeder-Root TLS4B Automatic Tank Gauge System","descriptions":[{"lang":"en","value":"The TLS4B ATG system is vulnerable to improper handling of Unix time values that exceed the 2038 epoch rollover. When the system clock reaches January 19, 2038, it resets to December 13, 1901, causing authentication failures and disrupting core system functionalities such as login access, history visibility, and leak detection termination. This vulnerability could allow an attacker to manipulate the system time to trigger a denial of service (DoS) condition, leading to administrative lockout, operational timer failures, and corrupted log entries."}],"affected":[{"vendor":"Veeder-Root","product":"TLS4B Automatic Tank Gauge System","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"11.A","versionType":"custom"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-25-296-03"},{"url":"https://www.veeder.com/us/network-security-reminder"},{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-03.json"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":7.1,"baseSeverity":"HIGH","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-190","description":"CWE-190 Integer Overflow or Wraparound","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2025-10-23T19:39:14.879Z"},"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:veeder-root:tls4b_automatic_tank_gauge_system:*:*:*:*:*:*:*:*","versionEndExcluding":"11.a","versionStartIncluding":"0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"credits":[{"lang":"en","type":"reporter","value":"Pedro Umbelino of Bitsight reported these vulnerabilities to CISA."}],"datePublic":"2025-10-23T18:11:00.000Z","source":{"advisory":"ICSA-25-296-03","discovery":"EXTERNAL"},"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span style=\"background-color: rgb(255, 255, 255);\">Veeder-Root is aware of the vulnerability and will provide a fix for it. Until a fix is available, users should adhere to the </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.veeder.com/us/network-security-reminder\">network security best practices</a><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;provided by Veeder-Root. Additionally, users should make all efforts to protect the borders of their environment to prevent bad actors from infiltrating and causing this issue.</span>\n\n<br>\n\n<p>Veeder-Root advises that their ASCs review and implement these best practices for network security with their users, when installing a new console or setting up a network port.</p><p>Contact Veeder-Root Technical Support at +1.800.323.1799 for additional help or questions.</p>"}],"value":"Veeder-Root is aware of the vulnerability and will provide a fix for it. Until a fix is available, users should adhere to the  network security best practices https://www.veeder.com/us/network-security-reminder  provided by Veeder-Root. Additionally, users should make all efforts to protect the borders of their environment to prevent bad actors from infiltrating and causing this issue.\n\n\n\n\nVeeder-Root advises that their ASCs review and implement these best practices for network security with their users, when installing a new console or setting up a network port.\n\nContact Veeder-Root Technical Support at +1.800.323.1799 for additional help or questions."}],"x_generator":{"engine":"Vulnogram 0.4.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-10-23T20:30:08.995752Z","id":"CVE-2025-55067","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-23T20:30:20.323Z"}}]}}}