Critical Flaws in All-Line Fuel-Boss Systems Allow Remote Code Execution

On August 27, 2026, CISA released an advisory (ICSA-26-239-02) detailing multiple vulnerabilities in All-Line Equipment Company's Fuel-Boss V1 series, a fuel management system deployed worldwide across critical infrastructure sectors. The advisory highlights two specific CVEs that, if exploited, could allow remote attackers to execute arbitrary commands or code on affected systems.

The first vulnerability, CVE-2018-19518, is an argument injection flaw in the University of Washington IMAP Toolkit 2007f, which is used in PHP's imap_open() function. The vulnerability allows attackers to inject arguments into an rsh command, potentially leading to remote OS command execution. This is particularly dangerous when an untrusted IMAP server name is supplied and rsh has been replaced by a program like ssh, enabling attacks via crafted server names containing '-oProxyCommand' arguments. Additionally, a stack-based buffer overflow in the same component could allow remote code execution.

The second vulnerability, CVE-2019-11043, is a buffer overflow in PHP-FPM that occurs under certain configurations. The FPM module can write past allocated buffers into space reserved for FastCGI protocol data, creating a condition that could be exploited for remote code execution.

Affected products include Fuel-Boss V1 Standard, V1 Portal, V1 Master/Slave, and V1 Backflush Systems, all running PHP versions up to and including 7.1.5. The CVSS scores for these vulnerabilities are high, with CVE-2019-11043 rated 8.7 (CVSS 3.1) and CVE-2018-19518 rated 7.5 (CVSS 3.1). Under CVSS 4.0, CVE-2019-11043 is rated critical at 9.4.

All-Line Equipment Company has provided fixes for the Fuel-Boss V1 Standard and V1 Portal models. However, fixes are not yet available for the V1 Master/Slave, and no fix is planned for the V1 Backflush Systems. As a mitigation, the vendor recommends taking unfixed products off the Internet or restricting IP access at the router level.

These vulnerabilities pose significant risks to organizations relying on Fuel-Boss systems for fuel management in critical infrastructure. Successful exploitation could lead to unauthorized access, data compromise, or disruption of fuel supply operations. Given the global deployment and the critical nature of the sectors involved, immediate action is advised.