Feds Sound Alarm on Exposed Fuel Tank Gauges as Hackers Probe Critical Infrastructure
CISA, FBI, NSA and DOE say internet-facing ATG systems at fuel depots, hospitals and military sites are being scanned and hit. The fix is mostly operator hygiene.
A joint advisory from CISA, the FBI, the NSA and the Department of Energy warns that threat actors are actively targeting internet-exposed automatic tank gauge (ATG) systems across multiple critical infrastructure sectors.
ATGs are the sensor-and-controller stacks that monitor fuel levels, temperature, leaks and inventory at gas stations, airports, refineries, military bases, hospitals and water treatment plants. Most speak proprietary serial protocols (Veeder-Root TLS-3xx/4xx, Franklin Fueling, OPW, Gilbarco) and were never designed for direct internet exposure.
They got exposed anyway. Operators routinely front-end them with serial-to-IP converters on TCP/10001 with no authentication.
The agencies say attackers — including state-aligned operators — have been scanning for these devices, sending unauthenticated commands, and in some cases manipulating tank readings or disabling leak detection. The operational impact is the part defenders should care about: a falsified reading can mask a real overfill or spill, trigger spurious shutdowns, or interrupt fuel supply at facilities that have no manual fallback.
No specific CVE is being headlined here. The advisory frames the problem as configuration and exposure, not a single patchable bug, though prior work on these platforms (CVE-2017-13663, CVE-2017-13664, CVE-2017-13665 against Veeder-Root) showed the underlying protocols offer essentially no security controls.
The guidance is blunt. Pull ATGs off the public internet. If remote monitoring is genuinely required, put the device behind a VPN with MFA and restrict source IPs. Segment ATG networks from corporate IT and from any other OT. Change default credentials on the management interfaces (many ship with blank or vendor-known passwords). Log command traffic and alert on unexpected serial commands like I20100 or setup-mode writes.
Asset owners can find their own exposure quickly. Shodan and Censys queries for the TLS-350 banner and TCP/10001 return thousands of hits globally, and the advisory encourages operators to assume they're in that dataset until they prove otherwise.
For a sector that still treats ATGs as plumbing telemetry rather than control systems, this is the second federal nudge in roughly a year. CISA flagged similar exposure in January 2024 (ICSA-24-019-01 covered Franklin Fueling Systems' TS-550 evo with a CVSS v3.1 base of 9.8).
The joint bulletin lists indicators of probing activity and recommends operators review firewall logs going back at least 90 days for unsolicited inbound traffic to ATG ports. The full advisory is on CISA's site at cisa.gov/news-events/cybersecurity-advisories.
One practical note for defenders: even if your ATG isn't internet-facing, audit the serial converter sitting next to it. That's where the exposure usually lives. The gauge itself is rarely the device with the public IP.
