The BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 suffers from an improper authentication vulnerability (CWE-287) in its system configuration module. Specifically, the /php/ajax-login.php endpoint responds with userid=1 (administrator) to any HTTP POST request with arbitrary credentials, bypassing authentication. Furthermore, privileged endpoints under /php/ajax-main.php and /modules/* do not validate server-side sessions, enabling remote unauthenticated attackers to invoke any administrative action exposed by the configuration module. This includes reading and modifying user rules, fuel tank gauges, fuel dispensers, relays, cash registers, bank terminals, fuel cards, price and customer displays, cash collection, and pricing rules. The vulnerability is publicly disclosed with a CVSS 4.0 score of 9.3 (critical). No patch or official remediation is currently documented.

A remote unauthenticated attacker can gain full administrative control over the gas station automation system. This includes the ability to read and modify critical operational parameters such as fuel dispensing controls, pricing, cash registers, and payment terminals. The improper authentication flaw effectively grants unrestricted access to sensitive system functions, potentially leading to operational disruption, financial fraud, and safety risks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected system's management interfaces to trusted personnel only. Monitor for unusual activity and consider isolating the system from untrusted networks. Do not rely on the system's authentication mechanisms as they are currently bypassable.