TLS4B ATG CVE-2025-58428

Requires network access to the TLS4B ATG system's SOAP-based web services handler AND possession of valid credentials for that interface (PR:L) - exploitation is not possible pre-authentication per the CVSS vector. No user interaction is needed (UI:N). The practical limiting factors are therefore (1) network reachability to the device's web services endpoint and (2) valid authentication; these are weakened in deployments where the ATG is internet-exposed or uses default/shared/weak credentials, which is common for such OT devices. No non-default feature toggle is cited - the SOAP interface accessibility is described as inherent to the web services handler.

Multiple signals converge on genuine priority, though not the extreme end of the scale. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, score 9.4) describes a network-reachable, low-complexity attack requiring only low privileges (valid credentials, PR:L) and no user interaction, yielding high confidentiality/integrity/availability impact on both the vulnerable and subsequent systems (SC:H/SI:H/SA:H) - consistent with the CWE-77 command-injection class and the description's claim of system-level command execution and full shell access. The EPSS score of 1.39% (71st percentile) is modest in absolute terms but above median, indicating meaningfully elevated - not negligible - exploitation likelihood. This is NOT a CISA KEV entry and no public exploit code is referenced, so there is no evidence of active exploitation or weaponization yet; the high CVSS is driven by impact and ease rather than observed attacks. The key tension: a 9.4 'critical' score sits against a low EPSS and no KEV/POC, meaning the theoretical severity is high but real-world exploitation has not been demonstrated. The PR:L requirement is the main mitigating factor and should temper raw-severity-driven prioritization - however, ICS/ATG devices are frequently deployed with weak, shared, or default credentials and are often internet-exposed, which can effectively erode the PR:L barrier. Reported by DHS ICS-CERT, lending credibility to the advisory.

An attacker who has obtained or guessed valid credentials reaches the TLS4B ATG system's SOAP web-services interface over the network and submits a crafted request that injects operating-system commands through the web services handler. Because the service executes these at the OS level, the attacker gains a shell on the underlying Linux host and can pivot to other systems on the operational-technology network. No public exploit code is referenced, and exploitation requires authentication (PR:L) but no user interaction.