The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a stark advisory highlighting two severe vulnerabilities in Veeder-Root’s TLS4B Automatic Tank Gauge System, a critical tool used in fuel storage and management across the energy sector.

These flaws, if exploited, could enable attackers to run arbitrary system-level commands on affected devices, potentially leading to widespread disruptions in critical infrastructure.

The primary vulnerability has a CVSS v4 score of 9.4, making it highly exploitable remotely and low-complexity, especially for those with basic credentials.

Veeder-Root, a U.S.-based company with global deployments, urges immediate upgrades to mitigate these risks, as reported by researcher Pedro Umbelino of Bitsight.

The vulnerabilities stem from flaws in the system’s handling of commands and time values, exposing Linux-based consoles to manipulation.

Discovered in systems deployed worldwide for monitoring underground storage tanks, they underscore ongoing challenges in securing industrial control systems (ICS) against sophisticated threats.

CISA emphasizes that these issues affect energy operations, where downtime could cascade into fuel supply interruptions or safety hazards.

Vulnerability Breakdown

The TLS4B system, versions prior to 11.A, suffers from a command injection flaw and an integer overflow related to the 2038 Unix epoch problem.

The command injection (CWE-77) arises in the SOAP-based web services interface, allowing authenticated remote attackers to inject malicious elements and execute Linux shell commands.

This could grant full system access, enabling data theft or further network compromise.

A secondary integer overflow (CWE-190) mishandles time values beyond the 2038 rollover, resetting the clock to 1901 and causing authentication failures, log corruption, and halted leak detection.

Attackers could exploit this for denial-of-service (DoS) by tampering with system time, locking out administrators, and disrupting operations.

Mitigations

Exploitation could yield remote command execution, lateral movement, administrative lockouts, and DoS conditions, severely impacting energy infrastructure reliability.

With low barriers to entry requiring only valid credentials, these flaws heighten risks for unpatched systems.

Veeder-Root recommends upgrading to TLS4B version 11.A for the command injection fix; for the overflow issue, a patch is in development, so users should follow network security best practices like isolating devices and securing ports.

CISA advises minimizing internet exposure, deploying firewalls, and using VPNs for remote access while conducting thorough risk assessments.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post CISA Warns Of Critical Veeder-Root Vulnerabilities Let Attackers Execute System-level Commands appeared first on Cyber Security News.

A new vulnerability in early versions of OpenVPN has been disclosed, potentially allowing malicious servers to execute arbitrary commands on client machines.

The flaw affects OpenVPN releases from 2.7_alpha1 to 2.7_beta1, enabling script-injection attacks on POSIX-based systems such as Linux, macOS, and BSD variants.

The issue stems from inadequate sanitization of the –dns and –dhcp-option arguments. When a client connects to an untrusted VPN service, these parameters are passed unsanitized to the –dns-updown script hook.

This oversight lets attackers embed malicious commands that run with elevated privileges on the client device, risking data theft, malware deployment, or full system compromise.

Security researchers warn that users relying on these beta builds for remote access or secure networking face immediate risks, especially in enterprise or personal setups involving third-party VPN providers.

OpenVPN – Script Injection Attack

Designated as CVE-2025-10680, the vulnerability has a CVSS score of 8.1 (high severity), highlighting its exploitability over the network without authentication.

It exploits the trust model where clients assume server-pushed DNS configurations are benign. On affected Unix-like systems, the –dns-updown script executes these inputs directly, opening the door to command injection.

Windows users are also impacted if using the built-in PowerShell integration, though the primary exposure remains on Linux and macOS.

Proof-of-concept exploits could involve crafting DNS strings with shell metacharacters, such as backticks or semicolons, to chain additional commands.

The OpenVPN project has confirmed no evidence of widespread exploitation yet, but urges immediate updates.

Patch Released With OpenVPN 2.7_beta2

Responding swiftly, the OpenVPN community released version 2.7_beta2 on October 27, 2025, incorporating critical fixes.

Key among them is enhanced input sanitation for DNS strings, blocking injection attempts from trusted-but-malicious servers.

The update also addresses Windows-specific issues, like improved event logging via a new openvpnservmsg.dll, and restores IPv4 broadcast configuration on Linux.

Additional bug fixes include better handling of multi-socket setups on Windows and repairs to DHCP options in TAP mode. Users should download the beta2 build from the official OpenVPN website and test in non-production environments.

For production use, sticking to stable 2.6.x releases remains advisable until 2.7 stabilizes. This incident underscores the importance of validating VPN software betas, particularly in diverse OS ecosystems.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post OpenVPN Vulnerability Exposes Linux, macOS Systems to Script Injection Attacks appeared first on Cyber Security News.

The Apache Software Foundation has highlighted critical flaws in Apache Tomcat, a widely used open-source Java servlet container that powers numerous web applications.

On October 27, 2025, Apache disclosed two vulnerabilities, CVE-2025-55752 and CVE-2025-55754, affecting multiple versions of Tomcat.

While the first poses a risk of remote code execution (RCE) under specific configurations, the second enables potential console manipulation, underscoring the need for immediate patching in enterprise environments.

These issues stem from regressions and unescaped sequences, potentially exposing servers to unauthorized access and control.​

Directory Traversal Flaw Enables RCE

The more severe vulnerability, CVE-2025-55752, involves a directory traversal bug introduced in the fix for an earlier issue (bug 60013).

In this regression, rewritten URLs are normalized before decoding, allowing attackers to manipulate query parameters and bypass protections for sensitive directories like /WEB-INF/ and /META-INF/.

If PUT requests are enabled, a configuration typically restricted to trusted users, malicious files can be uploaded, leading to RCE.

Discovered by Chumy Tsai of CyCraft Technology, this flaw is rated as Important severity, emphasizing its potential impact on unpatched systems running Tomcat in production.​

Affected versions include Apache Tomcat 11.0.0-M1 to 11.0.10, 10.1.0-M1 to 10.1.44, and 9.0.0-M11 to 9.0.108, with older end-of-life (EOL) releases also vulnerable.

The technical specifics revolve around URL rewriting rules that inadvertently allow path manipulation, exploiting the order of normalization and decoding processes to evade security constraints.​

​

Console Manipulation Through Log Escapes

In addition to the traversal issue, CVE-2025-55754 addresses improper neutralization of ANSI escape sequences in Tomcat’s log messages.

On Windows systems with ANSI-supporting consoles, attackers could craft URLs to inject sequences that manipulate the console display, clipboard, or even trick administrators into executing commands.

Although no direct attack vector was identified for other OSes, the potential for social engineering remains a concern. Rated Low severity, this flaw affects Tomcat 11.0.0-M1 to 11.0.10, 10.1.0-M1 to 10.1.44, and 9.0.0.40 to 9.0.108, plus select EOL versions like 8.5.60 to 8.5.100.​

Identified by Elysee Franchuk of MOBIA Technology Innovations, the issue arises from unescaped logs, allowing control sequences to influence terminal behavior without authentication.​

Experts note that while less critical, combining this with other flaws could amplify threats in console-monitored setups.​

Mitigations

Apache urges users to upgrade to mitigated versions: Tomcat 11.0.11, 10.1.45, or 9.0.109 and later, which address both vulnerabilities through enhanced URL handling and log escaping.

Organizations should audit configurations, particularly those enabling PUT requests alongside rewrites, to prevent RCE chains. Given Tomcat’s prevalence in Java-based applications, unpatched instances could face targeted attacks, echoing earlier exploits like CVE-2025-24813.​

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Apache Tomcat Security Vulnerabilities Expose Servers to Remote Code Execution Attacks appeared first on Cyber Security News.