Critical 9.9Published Oct 23, 2025

CVE-2025-58428Command Injection in Veeder-Root TLS4B Automatic Tank Gauge System

Updated under an hour ago (Oct 27, 2026, 4:50 AM ET)

Does this affect you?

It affects Veeder-Root TLS4B Automatic Tank Gauge System. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Veeder-Root TLS4B Automatic Tank Gauge System

Exploited in the last 30 days

The TLS4B ATG system's SOAP-based interface is vulnerable due to its accessibility through the web services handler. This vulnerability enables remote attackers with valid credentials to execute system-level commands on the underlying Linux system. This could allow the attacker to achieve remote command execution, full shell access, and potential lateral movement within the network.

CVSS: 9.9 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE): CWE-77
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: icscert
NVD analysis: Deferred
Record last updated: Oct 23, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Veeder-Root TLS4B Automatic Tank Gauge System veeder_root:tls4b_automatic_tank_gauge_system (from the name)	before 11.A; 11.A not affected	CNA record

References

References

https://www.cisa.gov/news-events/ics-advisories/icsa-25-296-03
https://www.veeder.com/us/software-downloads
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-03.json
https://www.veeder.com/us/network-security-reminder

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.