Feds Sound Alarm on Exposed Fuel Tank Gauges as Hackers Probe Critical Infrastructure
CISA, the FBI, NSA and DOE warn that internet-facing ATG systems at fuel depots, hospitals and military sites are being scanned and hit. The fix is mostly operator hygiene.
Key points
- CISA, the FBI, NSA and the Department of Energy have jointly warned that attackers are actively targeting internet-exposed automatic tank gauge systems.
- Threat actors, including state-aligned operators, are sending unauthenticated commands and manipulating tank readings.
- The problem is configuration and exposure, not a single patchable vulnerability.
- Defenders should pull ATGs off the public internet and, where remote access is essential, require a VPN with multi-factor authentication.
- Even an ATG that isn't internet-facing may be exposed through the serial-to-IP converter beside it.
What are ATGs and why do they matter?
Automatic tank gauge systems are the sensor-and-controller stacks that monitor fuel levels, temperature and leak detection at gas stations, airports, refineries, military bases and hospitals. Most run proprietary serial protocols from vendors including Veeder-Root, Franklin Fueling, OPW and Gilbarco. None of those protocols were designed for direct internet exposure, which makes what happened next predictable: operators connected them anyway, typically by fronting them with serial-to-IP converters carrying no authentication.
Should you worry about the operational impact?
Yes, and the reason is specific. A falsified reading can mask a real overfill, trigger spurious shutdowns or cut fuel supply at facilities with no manual fallback. Attackers don't need to own the network to cause harm here; unauthenticated command access is enough. That access, the advisory makes clear, already exists at scale. Shodan and Censys searches for common ATG banners return thousands of exposed devices globally, and the advisory encourages operators to assume they are in that dataset until they confirm otherwise.
No single CVE is being called out. The advisory frames this as a structural exposure problem, though prior research on these platforms showed the underlying protocols offer essentially no security controls.
What does the advisory actually tell defenders to do?
The guidance is direct. Pull ATGs off the public internet. Where remote monitoring is genuinely required, place the device behind a VPN with MFA and restrict source IPs. Segment ATG networks from corporate IT and from other operational technology. Change default credentials on management interfaces, many of which ship with blank or vendor-known passwords. Log command traffic and alert on unexpected serial commands including setup-mode writes.
The bulletin also asks operators to review firewall logs going back at least 90 days for unsolicited inbound traffic to ATG ports. The full advisory is on CISA's site at cisa.gov/news-events/cybersecurity-advisories.
Common questions
Is this the first federal warning on ATG security?
Not quite. CISA flagged similar ATG exposure risks in a prior advisory covering Franklin Fueling Systems equipment. This joint bulletin, pulling in the FBI, NSA and Department of Energy alongside CISA, signals a step up in the federal response. We have covered OT security in 32 stories over the past 90 days, and the recurring finding is the same one the agencies are making here: visibility into these environments is thin, and the exposure surface is larger than most asset owners believe.
What should a defender check first?
Audit the serial converter sitting next to the ATG before you worry about the gauge itself. That is typically where the public-facing exposure lives. The device with the routable IP is usually not the one labelled as the ATG.
The practical read on this advisory: it isn't breaking new technical ground, and the mitigations have been available for years. What has changed is the level of active probing the agencies are willing to document publicly. Operators who have been treating ATG connectivity as a low-priority hygiene item just had that calculation revised for them.
