Critical command injection flaw reported in Veeder-Root TLS4B automatic tank gauge system
Take action: If you use Veeder-Root TLS4B tank gauge systems, make sure they are isolated from the internet and accessible only from trusted networks. Then plan a patch to version 11.A or newer. The flaw still requires admin login so also work with the administrators for detecting phishing and avoiding malware.
Learn More
Veeder-Root is reporting multiple security vulnerabilities in its TLS4B Automatic Tank Gauge System, that could enable authenticated attackers to gain complete control over affected systems.
Vulnerabilities summary:
- CVE-2025-58428 (CVSS score 9.4): An improper neutralization of special elements used in a command injection vulnerability that affects the TLS4B ATG system's SOAP-based interface. This flaw enables remote attackers with valid credentials to execute system-level commands on the underlying Linux operating system. Successful exploitation could allow attackers to achieve remote command execution, gain full shell access to the system, and establish a foothold for potential lateral movement within the network.
- CVE-2025-55067 (CVSS score 7.1): An integer overflow or wraparound vulnerability stemming from the TLS4B ATG system's improper handling of Unix time values that exceed the 2038 epoch rollover threshold. When the system clock reaches January 19, 2038, at 03:14:07 UTC, the 32-bit signed integer used to store Unix timestamps will overflow, causing the system to reset to December 13, 1901. This integrity breach causes authentication failures and disrupts core system functionalities including login access, history visibility, and leak detection termination. Attackers aware of this cyber security threat could manipulate the system time to artificially trigger this denial of service condition, leading to administrative lockout, operational timer failures, and corrupted log entries.
All versions of the Veeder-Root TLS4B Automatic Tank Gauge System prior to version 11.A are affected by these vulnerabilities.
Veeder-Root has released a patch to address the command injection vulnerability and strongly recommends that users immediately upgrade their TLS4B systems to Version 11.A.
For the integer overflow vulnerability, Veeder-Root has acknowledged the threat and is developing a fix. Until a patch becomes available, users should applu isolation to minimize exposure to potential attacks.
