The vulnerability exists in the system configuration module of the Nefteprodukttekhnika BUK TS-G Gas Station Automation System. A POST request to /php/ajax-login.php returns a userid of 1, granting administrator privileges regardless of supplied credentials. Subsequent calls to privileged endpoints under /php/ajax-main.php and /modules/ lack server-side session validation, providing unauthenticated users full administrative control.

Affected are Linux installations of the BUK TS-G Gas Station Automation System from version 2.9.1 through 2.10.2. The control of these versions is commonly deployed at fuel dispensing establishments. The vulnerability is specific to the mentioned versions and does not affect earlier releases.

The CVSS score of 9.3 reflects a high severity with potential for full system compromise. Although the EPSS score is not available, the flaw is trivially exploitable via ordinary HTTP requests, and the system does not expose any defensive controls. The vulnerability is not listed in the CISA KEV catalog, so no known exploitation campaigns are currently documented, but the straightforward attack vector makes it attractive to threat actors. Attackers can manipulate fuel dispensers, relays, cash registers, bank terminals, and pricing displays, effectively taking complete control of a gas station's operations.