CISA 2026-08-27

All-Line Equipment Company Fuel-Boss

Machine-generated analysis · WAYSCloud LLM

Fuel-Boss V1 products running PHP 7.1.5 are vulnerable to remote command execution via crafted IMAP server names.

Context

The advisory concerns All-Line Equipment Company Fuel-Boss V1 (Standard, Portal, Master/Slave, Backflush Systems) running PHP 7.1.5. It states that CVE-2018-19518 and CVE-2019-11043 allow remote attackers to execute arbitrary OS commands or code by exploiting argument injection in the IMAP toolkit. The vulnerability can be triggered when an untrusted IMAP server name includes a “-oProxyCommand” argument, potentially leveraging rsh or replaced programs such as ssh.

Operator considerations

Check: inventory Fuel-Boss installations and verify PHP version is 7.1.5.
Isolate: segment Fuel-Boss systems from untrusted networks and restrict outbound IMAP connections.
Log: monitor for imap_open calls with external server names or unusual proxy command arguments.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of these vulnerabilities could allow attackers to execute arbitrary commands or code remotely on affected systems.

The following versions of All-Line Equipment Company Fuel-Boss are affected:

Fuel-Boss V1 Standard >=|=|=|=|=|

Read the full advisory on CISA →