CVE-2026-12183 CRITICAL

CVE-2026-12183: Nefteprodukttekhnika BUK TS-G Gas Station Automation System Authentication Bypass via ajax-login.php Accepting Arbitrary Credentials

Vendor Nefteprodukttekhnika Llc
Product BUK TS-G Gas Station Automation System
Weakness CWE-287 · Improper authentication
Published June 13, 2026
Last update August 10, 2026
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

What the vulnerability does

01Description

Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux contains an Improper Authentication vulnerability (CWE-287) in the system configuration module.

Key dates

02Disclosure timeline

June 13, 2026 CVE published
August 10, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-25227 [20250402] - Joomla Core - MFA Authentication Bypass CVE-2024-11015 Sign In With Google <= 1.8.0 - Authentication Bypass in authenticate_user CVE-2023-48747 WordPress Booster for WooCommerce plugin <= 7.1.2 - Authenticated Production Creation/Modification Vulnerability CVE-2026-3655 OTP Login With Phone Number, OTP Verification <= 1.8.60 - Unauthenticated Authentication Bypass via Firebase OTP Verification CVE-2026-0953 Tutor LMS Pro <= 3.9.5 - Authentication Bypass via Social Login