Threat reportICS/SCADATL-2026-0708
Active Exploitation of Internet-Exposed Automatic Tank Gauge (ATG) Systems in U.S. Critical Infrastructure — CISA/FBI/NSA/DOE Joint Advisory (CVE-2025-58428, Veeder-Root TLS4B & Multi-Vendor ATG Flaws)
Active Exploitation of Internet-Exposed Automatic Tank Gauge (TL-2026-0708), also tracked as ATG fuel gauge attacks, is a high-severity ICS/SCADA threat scored CVSS 9.9, first published 2026-06-07. It has no confirmed attribution, affects Veeder-Root TLS4B Automatic Tank Gauge, references 13 CVEs (CVE-2025-58428, CVE-2025-55067, CVE-2024-45066), maps to 18 MITRE ATT&CK techniques (T0836, T0878, T0879), and is covered by 9 detection rules and 14 indicators of compromise.
- CVSS
- 9.9/10High
- CVEs
- 13Referenced vulnerabilities
- Techniques
- 18MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 14Indicators of compromise
Key facts for TL-2026-0708
- Threat ID
- TL-2026-0708
- Also known as
- ATG fuel gauge attacks, Fuel Tank Monitoring System attacks, Veeder-Root TLS4B RCE
- Severity
- HIGH
- CVSS
- 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- ICS_SCADA
- First published
- Last reviewed
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- energy, chemical, food and agriculture, transportation, government, healthcare
- Target regions
- North America, United States
- Detection rules
- 9
- Indicators of compromise
- 14
How Active Exploitation of Internet-Exposed Automatic Tank Gauge works
CISA, FBI, NSA, DOE and partner agencies issued a joint advisory confirming active malicious cyber activity against internet-exposed Automatic Tank Gauge (ATG) systems in U.S. critical infrastructure. Threat actors are connecting to exposed devices over TCP/10001 and via web/SOAP interfaces to modify tank parameters, disable alarms, cycle relays, and execute OS-level commands. Over 1,000 ATG systems are internet-exposed, 909 of them in the United States.
Automatic Tank Gauge (ATG) systems monitor fuel storage tank levels, temperature, and leak detection at gas stations, airports, military bases, hospitals, and other critical-infrastructure sites. On 2026-06, CISA, the FBI, NSA, and DOE — joined by EPA, TSA, DOT and USDA — released a joint advisory warning of ongoing malicious activity against internet-exposed ATGs and urging immediate hardening.
The core exposure is architectural: the legacy ATG serial protocol (Veeder-Root TLS-style command set, e.g. function codes like I20100/relay function code 809) was designed for RS-232 and is now reachable over a raw TCP socket on port 10001. The protocol's only access control is an optional 6-character 'security code' (~1M combinations) that is disabled by default on many devices, allowing any unauthenticated client to read and modify tank configuration as if physically wired to the console.
Beyond the protocol exposure, multiple authenticated and unauthenticated software vulnerabilities affect ATG web/management interfaces. Veeder-Root TLS4B is affected by CVE-2025-58428, a CVSS 9.9 command injection in its SOAP-based web services interface allowing remote attackers to execute system-level commands and gain full shell on the underlying Linux OS, and CVE-2025-55067 (CVSS 7.1), an integer overflow in Unix time handling (Year-2038 epoch rollover) enabling DoS/administrative lockout. Separately, Bitsight disclosed 11 vulnerabilities across six ATG models from five vendors — Maglink LX/LX4, OPW SiteSentinel, Proteus OEL8000, Alisonic Sibylla, and Franklin TS-550 — spanning OS command injection (CVE-2024-45066, CVE-2024-43693 — both CVSS 10.0), hardcoded credentials (CVE-2024-43423), authentication bypass (CVE-2024-8310, CVE-2024-6981, CVE-2024-43692), SQL injection (CVE-2024-8630), reflected XSS (CVE-2024-41725), privilege escalation (CVE-2024-45373), and arbitrary file read (CVE-2024-8497).
Observed and demonstrated impact is physical, not merely informational. Attackers can modify tank capacity/geometry to defeat overflow protection (spillage/environmental risk), disable high-level and leak alarms, and abuse relay-control functions (ATG function code 809) to rapidly cycle peripheral relays — a living-off-the-land technique shown to physically destroy relays (OMRON G6S-2 failed after ~6.25 hours of ~50 Hz cycling) controlling pumps, ventilation, and emergency shutoff valves, as well as trigger device reboot/DoS. In April 2026, attacks against ATGs in Tennessee deleted tank and sensor configuration on unprotected internet-exposed Veeder-Root TLS-350 and TLS-450 Plus consoles, with at least 15 tanks affected at one convenience-store chain. The U.S. government has not formally attributed the current activity; prior 2025 ATG intrusions at U.S. gas stations were linked by CNN/SC Media reporting to suspected Iranian actors.
MITRE ATT&CK techniques used in TL-2026-0708
Impair Process Control
T0836 Modify Parameter; T1692.001 Command Message
Inhibit Response Function
Impact
T0879 Damage to Property; T1489 Service Stop; T1499 Endpoint Denial of Service; T1529 System Shutdown/Reboot; T1565 Data Manipulation
Discovery
T1046 Network Service Discovery
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation
stealth
Credential Access
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application
Reconnaissance
Affected products and versions in Active Exploitation of Internet-Exposed Automatic Tank Gauge
- Veeder-Root — TLS4B Automatic Tank Gauge
Vulnerable versions: prior to 11.A
Fixed in: 11.A - Veeder-Root — TLS-350 / TLS-450 Plus consoles
Vulnerable versions: internet-exposed without security code - Maglink — LX / LX4 Console
Vulnerable versions: affected firmware
Fixed in: vendor-updated firmware - OPW — SiteSentinel
Vulnerable versions: affected firmware
Fixed in: vendor-updated firmware - Proteus — OEL8000
Vulnerable versions: affected firmware
Fixed in: vendor-updated firmware - Alisonic — Sibylla
Vulnerable versions: affected firmware - Franklin Fueling Systems — TS-550
Vulnerable versions: affected firmware
Fixed in: vendor-updated firmware
Remediation for Active Exploitation of Internet-Exposed Automatic Tank Gauge
Patches
- Upgrade Veeder-Root TLS4B to Version 11.A (fixes CVE-2025-58428)
- Apply vendor firmware updates for Maglink LX/LX4, OPW SiteSentinel, Proteus OEL8000, Alisonic Sibylla, and Franklin TS-550
Immediate actions
- Disconnect ATG consoles from the public internet; place behind a firewall/VPN and never expose TCP/10001 or web management interfaces directly
- Enable and set a strong, non-default ATG security code on every console where supported
- Block inbound TCP/10001 and ATG web/SOAP interfaces at the perimeter; restrict to an allowlist of management hosts
- Audit Shodan/Censys exposure for your ATG public IP ranges and remove any exposed devices
Workarounds
- For CVE-2025-55067 (no patch): apply strict network segmentation and restrict management access pending vendor update
- Disable unused web/SOAP and remote-connectivity services on the console
Longer-term hardening
- Apply network segmentation isolating OT/ICS ATG networks from IT and internet per CISA guidance
- Deploy monitoring/IDS for anomalous ATG protocol commands (config changes, relay function code 809, alarm disablement)
- Inventory all ATG assets, vendors, models, and firmware; establish a patch-management program for ICS devices
- Enforce least-privilege accounts and remove default/hardcoded credentials where vendor updates permit
CVEs associated with Active Exploitation of Internet-Exposed Automatic Tank Gauge
Weaknesses (CWE) in Active Exploitation of Internet-Exposed Automatic Tank Gauge
CWE-77, CWE-78, CWE-190, CWE-287, CWE-798, CWE-89, CWE-79, CWE-269, CWE-306
Timeline of Active Exploitation of Internet-Exposed Automatic Tank Gauge
- Bitsight discloses 11 vulnerabilities across six ATG models from five vendors, including two CVSS 10.0 OS command injection flaws and ~6,500 internet-exposed devices.
- CISA publishes ICS advisory ICSA-25-296-03 for Veeder-Root TLS4B, including CVE-2025-58428 (CVSS 9.9 command injection) and CVE-2025-55067 (CVSS 7.1 integer overflow).
- Cyberattacks against ATGs in Tennessee delete tank/sensor configuration on internet-exposed Veeder-Root TLS-350 and TLS-450 Plus consoles; at least 15 tanks affected at one convenience-store chain.
- CNN/SC Media reporting links prior ATG intrusions at U.S. gas stations to suspected Iranian actors (not confirmed by U.S. government).
- Shadowserver reports over 1,000 ATG systems internet-exposed, 909 of them in the United States.
- CISA, FBI, NSA, DOE with EPA/TSA/DOT/USDA issue a joint advisory confirming active malicious activity against internet-exposed ATGs and urging hardening.
- Threadlinqs Intelligence documents the campaign with full MITRE mapping, IOCs, and detection coverage.
Sources cited for Active Exploitation of Internet-Exposed Automatic Tank Gauge
- CISA and Partners Urge Hardening Automatic Tank Gauge Systems
- Veeder-Root TLS4B Automatic Tank Gauge System (ICSA-25-296-03)
- Over 900 US gas station tank gauge systems exposed to attacks
- Critical Vulnerabilities Discovered in Automated Tank Gauge Systems
- CISA Warns Critical Veeder-Root TLS4B RCE (CVE-2025-58428)
- Iran suspected in breaching automatic tank gauges at US gas stations
- Many Fuel Tank Monitoring Systems Vulnerable to Disruption
Detection coverage for TL-2026-0708
As of 2026-06-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0708 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.