All-Line Equipment Company Fuel-Boss: 2 CVEs, High 8.7
Summary
CISA reports 2 vulnerabilities in All-Line Equipment Company Fuel-Boss V1 Standard, Fuel-Boss V1 Portal, Fuel-Boss V1 Master/Slave, Fuel-Boss V1 Backflush Systems. Weakness types: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'), Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'). Successful exploitation of these vulnerabilities could allow attackers to execute arbitrary commands or code remotely on affected systems. Highest CVSS v3 score: 8.7 (High), exploitable over the network. At least one CVE is on CISA's Known Exploited Vulnerabilities list.
At a glance
- Vendor
- All-Line Equipment Company
- Products
- Fuel-Boss V1 Standard, Fuel-Boss V1 Portal, Fuel-Boss V1 Master/Slave, Fuel-Boss V1 Backflush Systems
- CVEs
- CVE-2018-19518, CVE-2019-11043
- Highest CVSS v3
- 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
- Highest CVSS v4
- –
- Known exploited (KEV)
- Yes
- Sectors (per CISA)
- Critical Manufacturing, Defense Industrial Base, Emergency Services, Transportation Systems
- Deployed
- Worldwide
- Vendor HQ
- United States
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2018-19518 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') | 7.5 | – | No | Fuel-Boss is vulnerable to the University of Washington IMAP Toolkit 2007f on UNIX, used in imap_open() in PHP and other products, launching an rsh command via the imap_rimap and tcp_aopen functions without preventing argument injection, which can allow remote attackers to execute arbitrary OS commands when an untrusted IMAP server name is supplied and rsh has been replaced by a program with diffe… |
| CVE-2019-11043 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | 8.7 | – | Yes (added 2022-03-25) | Fuel-Boss running versions up to and including PHP 7.1.5 is vulnerable because certain FPM configurations allow the FPM module to write past allocated buffers into space reserved for FCGI protocol data, thereby creating a possible remote code execution condition. |
Affected products (4)
- All-Line Equipment Company Fuel-Boss V1 Standard: >=|<=PHP_7.1.5_7.1.5
- All-Line Equipment Company Fuel-Boss V1 Portal: >=|<=PHP_7.1.5_7.1.5
- All-Line Equipment Company Fuel-Boss V1 Master/Slave: >=|<=PHP_7.1.5_7.1.5
- All-Line Equipment Company Fuel-Boss V1 Backflush Systems: >=|<=PHP_7.1.5_7.1.5
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Fixes are available for the Fuel-Boss V1 Standard and Fuel-Boss V1 Portal. Please contact All-Line Equipment Company (866-356-3336) for instructions on how to receive these fixes.
- Vendor Fix: Fixes are not yet available for the Fuel-Boss V1 Master/Slave.
- Vendor Fix: No fix is planned for Fuel-Boss V1 Backflush Systems.
- Mitigation: All-Line Equipment Company recommends either taking products that are not fixed off the Internet or restricting the IP addresses that can access them at the router level.
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.