CISA warns of Fuel-Boss flaws that could let attackers execute code remotely
CISA says several All-Line Equipment Company Fuel-Boss products contain two vulnerabilities that could let an attacker run commands or code remotely, with fixes available for some versions and not others.
CISA has issued an advisory on All-Line Equipment Company’s Fuel-Boss product line, warning that multiple versions are affected by two vulnerabilities that could let an attacker execute commands or code remotely on exposed systems.
CISA says the affected products are used in critical manufacturing, defense industrial base, emergency services and transportation systems. The agency also says some versions still do not have a fix, leaving operators dependent on network restrictions and other mitigations.
What CISA said
The advisory names four affected product lines: Fuel-Boss V1 Standard, Fuel-Boss V1 Portal, Fuel-Boss V1 Master/Slave and Fuel-Boss V1 Backflush Systems. CISA lists the vendor as All-Line Equipment Company, based in the United States, and says the product is deployed worldwide.
CISA identifies two CVEs. CVE-2018-19518 is described as an argument-injection issue in the University of Washington IMAP Toolkit 2007f on UNIX, used in PHP’s imap_open(). CISA says an untrusted IMAP server name can lead to remote operating system command execution, and that server names containing “-oProxyCommand” may be used in attacks. The advisory also says the flaw may permit a stack-based buffer overflow that enables remote code execution.
CISA assigns CVE-2018-19518 a CVSS v3.1 score of 7.5, or High, and a CVSS v4.0 score of 7.7, also High.
The second issue, CVE-2019-11043, affects PHP up to and including version 7.1.5. CISA says certain PHP-FPM configurations can allow the module to write past allocated buffers into FCGI protocol data, creating a possible remote code execution condition. CISA rates the issue 8.7 under CVSS v3.1 and 9.4, Critical, under CVSS v4.0.
The agency says the vulnerabilities were anonymously reported to CISA.
What users should do
CISA says fixes are available for Fuel-Boss V1 Standard and Fuel-Boss V1 Portal, and instructs users to contact All-Line Equipment Company at 866-356-3336 for instructions. Fixes are not yet available for Fuel-Boss V1 Master/Slave, and no fix is planned for Fuel-Boss V1 Backflush Systems.
CISA says unfixed products should be removed from the Internet or restricted by IP address at the router level. The advisory also recommends minimizing network exposure and using VPNs for remote access.
The advisory was first released on 2026-08-27.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
View the Web StoryA visual, tap-through version of this reportThis is the AMP version of the article. Read the full article on Atlas Watchline.