PT-2026-49099 · Nefteprodukttekhnika Llc · Buk Ts-G Gas Station Automation System

Qahramon Choriyev · Published 2026-06-13 · Updated 2026-06-13 · CVE-2026-12183

Mitre

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux contains an Improper Authentication vulnerability (CWE-287) in the system configuration module. The /php/ajax-login.php endpoint returns userid=1 (administrator) in response to any HTTP POST request that supplies arbitrary credentials (e.g., action=dologin&login=&pwd=), and subsequent privileged endpoints under /php/ajax-main.php and /modules/* do not validate a server-side session. A remote unauthenticated attacker can invoke any administrative action exposed by the configuration module, including reading and modifying user rules, fuel tank gauges, fuel dispensers, relays, cash registers, bank terminals, fuel cards, price and customer displays, cash collection, and pricing rules.

Exploit

Fix

Missing Authentication

Improper Authentication

Weakness Enumeration

CWE-306

CWE-287

Related Identifiers

CVE-2026-12183

Affected Products

Buk Ts-G Gas Station Automation System

References · 5

• 🔥 https://github.com/ciprobe/bukts_auth_bypass · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-12183 · Security Note
• https://bukts.ru/repo-bukts-current · Vendor Advisory
• https://cwe.mitre.org/data/definitions/306.html · Note
• https://cwe.mitre.org/data/definitions/287.html · Note