CISA Warns of Critical Vulnerabilities in Automatic Tank Gauge Systems

Key Takeaways

• Multiple U.S. federal agencies have issued a joint warning about active cyberattacks targeting Automatic Tank Gauge (ATG) systems.
• Threat actors are exploiting internet-exposed ATG devices, often with weak credentials, to gain full control and manipulate critical industrial processes.
• The vulnerabilities allow attackers to alter fuel levels, disable alerts, and potentially cause physical damage or environmental hazards across various critical sectors.
• Immediate action is required, including removing ATG systems from direct internet exposure, implementing strong authentication, and applying security updates.

A concerning trend has emerged in the cybersecurity landscape, with critical infrastructure components, specifically Automatic Tank Gauge (ATG) systems, becoming targets of an escalating wave of cyberattacks. These systems, vital for monitoring liquid levels, temperatures, and potential leaks in storage tanks across diverse sectors, are now facing active exploitation by malicious actors.

ATG systems operate largely unseen, yet they are indispensable for maintaining operations at critical facilities such as gas stations, agricultural sites, chemical plants, and transportation hubs. Their deployment spans the Energy, Chemical, Food and Agriculture, and Transportation sectors, where they automate tasks that would otherwise demand constant manual oversight.

However, the very network connectivity that makes ATGs so efficient has also rendered them vulnerable. Attackers are leveraging the widespread issue of these systems being directly exposed to the internet, frequently protected only by default or easily guessable passwords.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the FBI, NSA, DOE, EPA, TSA, DOT, and USDA, has issued a joint advisory confirming ongoing malicious cyber activity against U.S.-based ATG systems. These agencies report that threat actors are successfully compromising internet-exposed devices and executing direct commands to modify system behavior. While the activity is confirmed, the U.S. government has not yet attributed these attacks to any specific nation-state or known threat group.

These are not merely theoretical threats. Attackers are gaining unauthorized access, running arbitrary commands, and in some instances, achieving complete control over these systems. This level of access allows them to alter network configurations, manipulate tank volume readings, adjust pump controls, and disable crucial alert mechanisms designed to flag dangerous conditions.

The ramifications of such compromises extend beyond digital intrusion. A hijacked ATG system can induce a “denial of view” scenario, where operators receive inaccurate or no information about tank fill levels. If undetected, this could lead to severe consequences, including physical damage to infrastructure, environmental spills, or hazardous incidents stemming from relay failures.

CISA and Partners Warn of Cyberattacks

The methods employed by attackers, as detailed in the advisory, are not highly sophisticated but have proven remarkably effective. Threat actors exploit vulnerabilities such as authentication bypasses and hardcoded credentials to circumvent device management interfaces without valid login information. Once a foothold is established, they utilize operating system command execution and SQL injection techniques to run arbitrary code and manipulate the databases that manage tank data.

This initial access often leads to privilege escalation, granting attackers full administrative control over both the device’s software and its underlying operating system. With this elevated access, they can force devices to report false readings, suppress critical safety alarms, or cause components to malfunction in ways that are difficult to detect until significant damage has occurred. The simplicity of these attack vectors is particularly alarming given the extensive deployment of ATG devices across vital industries.

What You Should Do

• Isolate Systems: Immediately remove ATG systems from direct internet exposure. The serial port (typically on TCP ports 8001, 9001, or 10001) must not be publicly accessible. Implement robust firewalls, access control lists, or VPNs for any necessary remote access.
• Strengthen Authentication: Change all default passwords without delay. Implement strong, unique credentials for every interface, including the serial port. Enable phishing-resistant multifactor authentication (MFA) wherever technically feasible.
• Patch and Update: Ensure all ATG system software is up to date. Work with certified service providers to apply the latest manufacturer patches and firmware updates promptly.
• Monitor and Log: Enable comprehensive logging on all ATG systems. Regularly audit these logs for any signs of unauthorized access attempts, unusual alarm activity, or unexpected configuration changes.
• Report Incidents: Any suspected cybersecurity incidents involving ATG systems should be reported immediately to CISA at [email protected] or by calling 888-282-0870. Additionally, complaints can be filed with the FBI through the Internet Crime Complaint Center (www.ic3.gov).

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.