Nefteprodukttekhnika Llc - Buk Ts-g Gas Station Automation System - CRITICAL - CVE-2026-12183. The Nefteprodukttekhnika BUK TS-G Gas Station Automation System versions 2.9.1 through 2.10.2 on Linux presents an Improper Authentication flaw within its system configuration module. The /php/ajax-login.php endpoint reveals the administrator's user ID in response to any HTTP POST request containing arbitrary credentials, effectively bypassing authentication. Post-login, privileged endpoints such as /php/ajax-main.php and various modules fail to verify session integrity, enabling unauthorized remote attackers to execute privileged operations. This includes potential modifications to critical system settings, such as user roles, fuel management equipment, financial transactions, and more. BADGES: 👾 EXPLOITED | 🟡 PoC | SecurityVulnerability.io