EUVD-2026-36653
GHSA-4vgc-3whg-978w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Endpoint is network-reachable and the login bypass is trivial (AV:N/AC:L/PR:N/UI:N); full admin control over the application yields C:H/I:H/A:H with no scope change to a separate security authority.
Primary rating from Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c).
CVSS VectorVendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux contains an Improper Authentication vulnerability (CWE-287) in the system configuration module. The /php/ajax-login.php endpoint returns userid=1 (administrator) in response to any HTTP POST request that supplies arbitrary credentials (e.g., action=dologin&login=<any_value>&pwd=<any_value>), and subsequent privileged endpoints under /php/ajax-main.php and /modules/* do not validate a server-side session. A remote unauthenticated attacker can invoke any administrative action exposed by the configuration module, including reading and modifying user rules, fuel tank gauges, fuel dispensers, relays, cash registers, bank terminals, fuel cards, price and customer displays, cash collection, and pricing rules.
Articles & Coverage 1
AnalysisAI
Remote unauthenticated authentication bypass in Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux allows any HTTP client to obtain administrator-level access by POSTing arbitrary credentials to /php/ajax-login.php, which unconditionally returns userid=1. Downstream privileged endpoints under /php/ajax-main.php and /modules/* fail to validate a server-side session, exposing full control over fuel dispensers, tank gauges, pricing, POS, bank terminals, and relays. No public exploit identified at time of analysis, but a public reference to a proof-of-concept repository (ciprobe/bukts_auth_bypass) suggests trivially reproducible exploitation against ICS/OT infrastructure.
Technical ContextAI
BUK TS-G is a PHP-based industrial control / SCADA-style web application used by Russian-market gas (fuel) station operators to manage tank gauges, dispensers, pricing displays, fuel-card terminals, cash registers, and relay outputs. The root cause is classified as CWE-287 (Improper Authentication): /php/ajax-login.php hard-codes a successful login response (userid=1, the administrator account) regardless of the credentials supplied, and the surrounding application architecture never re-validates an authenticated session token on subsequent calls to /php/ajax-main.php or /modules/*. This is effectively the textbook 'authentication ceremony returns success without verifying anything' pattern, closely overlapping with CWE-306 (Missing Authentication for Critical Function), which is also referenced in the NVD record.
RemediationAI
No vendor-released patch identified at time of analysis - the NVD references point only to the vendor repository (https://bukts.ru/repo-bukts-current) and a researcher PoC (https://github.com/ciprobe/bukts_auth_bypass), not a fixed version. Operators should immediately remove the BUK TS-G web interface from any network reachable by untrusted clients by placing it behind a VPN or restricting source IPs at the perimeter firewall to known operator workstations, since the bypass is pre-authentication and any network exposure equals full compromise. As a tactical web-layer mitigation, block external access to /php/ajax-login.php, /php/ajax-main.php, and /modules/* at a reverse proxy and require an additional layer of HTTP basic auth or mTLS in front of the application; the trade-off is that legitimate remote operators and integrators will need to be re-provisioned with the new credentials and station-management tooling may break until reconfigured. Monitor https://bukts.ru/repo-bukts-current for an updated release above 2.10.2 and apply it as soon as one is published.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today