Gas Station Systems Bypass Authentication Without Credentials

Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux contains an Improper Authentication vulnerability (CWE-287) in the system configuration module. The /php/ajax-login.php endpoint returns userid=1 (administrator) in response to any HTTP POST request that supplies arbitrary credentials (e.g., action=dologin&login=<any_value>&pwd=<any_value>), and subsequent privileged endpoints under /php/ajax-main.php and /modules/* do not validate a server-side session. A remote unauthenticated attacker can invoke any administrative action exposed by the configuration module, including reading and modifying user rules, fuel tank gauges, fuel dispensers, relays, cash registers, bank terminals, fuel cards, price and customer displays, cash collection, and pricing rules.

Casky was already ahead

This CVE exploits attack patterns that Casky's 261matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Nefteprodukttekhnika BUK TS-G Gas Station Automation System versions 2.9.1 through 2.10.2 contain a critical authentication bypass vulnerability that allows attackers to gain administrative access without valid credentials. The vulnerable /php/ajax-login.php endpoint accepts any arbitrary username and password combination and returns administrator privileges (userid=1), while downstream endpoints fail to validate server-side sessions. This affects operational technology (OT) environments managing critical fuel distribution infrastructure, with potential impacts on fuel supply chains, pricing systems, and operational continuity. Organizations running these versions face immediate risk of unauthorized system access, data manipulation, and potential disruption to gas station operations.

Casky's 261 matching skills leverage Claude's extended reasoning to detect the initial access and privilege escalation patterns (MITRE TA0004, TA0006) characteristic of this vulnerability. Practitioners would observe security findings highlighting improper authentication workflows (CWE-287) and missing session validation (CWE-306), with detection focused on: unauthenticated POST requests to /php/ajax-login.php with suspicious parameter patterns, administrative user IDs returned without credential validation, and subsequent API calls to /php/ajax-main.php lacking session tokens or with invalid session states. The platform's skill mapping enables practitioners to correlate these behavioral anomalies with known OT exploitation patterns, triggering alerts when legitimate authentication flows are bypassed or when privileged operations execute without proper session management—critical indicators of active exploitation in gas station automation environments.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

261 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-12183.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-kubernetes-audit-logs

container security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-12183

Casky has 261 skills that investigate the attack patterns behind CVE-2026-12183. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn