AI analysis
A time-based blind SQL injection flaw (CWE-89) affects the reportType parameter of the product summary report in the balancing reports section of Toptech TMS7 and TopHAT. An attacker who already holds high-privilege access can send a crafted reportType value over the network, with no user interaction, and infer database contents from response timing. Impact is rated high for confidentiality and availability and low for integrity on both the vulnerable system and subsequent systems (CVSS 4.0 base 8.5). These are industrial terminal-management products typically used at bulk-liquid facilities. The CVE is not in CISA KEV and no public proof-of-concept is known.
What to do: Apply the vendor fix for Toptech TMS7 and TopHAT as soon as a patched release is available; no fixed version is named in the advisory data. Until then, keep the balancing-reports interface off the internet, restrict it to trusted high-privilege operators, and review application and database logs for unusual reportType values or response-time patterns consistent with blind SQL injection.
Affected
| Toptech TMS7 | — |
| Toptech TopHAT | — |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.