As reported by CISA in advisory ICSA-26-239-02, All-Line Equipment Company's Fuel-Boss product line carries critical vulnerabilities dating back nearly a decade — a stark reminder that operational technology environments often inherit the technical debt of their software dependencies long after upstream patches become available.
Vulnerability Details
| CVE | CVSS v3 | Severity | Type | Exploitation |
|---|---|---|---|---|
| CVE-2018-19518 | 8.7 | High/Critical | Argument Injection / Buffer Overflow via imap_open() | Public PoC available since 2018 |
| CVE-2019-11043 | 9.8 | Critical | PHP-FPM RCE (nginx + PHP-FPM misconfiguration) | Mass scanning observed historically |
Affected Products
Patch Status: Fixes are available for V1 Standard and V1 Portal by contacting All-Line Equipment Company directly at 866-356-3336. No fix is listed yet for Master/Slave or Backflush variants.
Active Exploitation: No exploitation of Fuel-Boss systems specifically has been confirmed by CISA, but both CVEs have been weaponized in the wild against general PHP deployments for years.
Why This Matters
Fuel-Boss is deployed across four critical infrastructure sectors — Critical Manufacturing, Defense Industrial Base, Emergency Services, and Transportation Systems — and is installed worldwide. Fuel management systems at fleet depots, military installations, and emergency response facilities are not typical IT assets; they sit in physically segregated environments with long replacement cycles and minimal monitoring. An attacker achieving remote code execution on a fuel management console could manipulate dispensing operations, alter accounting records, or pivot into the broader facility network.
The core problem here is not a novel zero-day. It's that a 2026-vintage ICS product is still shipping or running on PHP 7.1.5, a branch that reached end-of-life in December 2019. Both CVE-2018-19518 and CVE-2019-11043 have had upstream fixes for over seven years.
This pattern — ICS vendors inheriting vulnerable runtime stacks and never forcing upgrades — is endemic. Defenders cannot assume that a vendor advisory means the vendor has a clean remediation path. In this case, two of the four affected product variants have no published fix at all.
Who Is Most at Risk
- Defense Industrial Base: Fleet fueling infrastructure at military installations — high-value targets for pre-positioning and sabotage
- Emergency Services: Fuel dispensing for fire, EMS, and police fleets where downtime is safety-critical
- Transportation: Commercial fleet depots and transit authorities with internet-facing management portals
- Any deployment with the Portal variant exposed to the internet — CVE-2019-11043 is trivially exploitable with public tooling
Immediate Actions
- Inventory and identify: Locate all Fuel-Boss systems across all facilities. Check the web interface or PHP version banner to confirm whether PHP 7.1.5 or earlier is running.
- Apply vendor fixes: For V1 Standard and V1 Portal, contact All-Line Equipment Company at 866-356-3336 immediately to obtain and apply patches.
- Isolate unpatchable systems: For V1 Master/Slave and V1 Backflush variants with no available fix, place systems behind a restrictive firewall, disable any internet exposure, and restrict management access to a dedicated jump host on a segmented VLAN.
- Block PHP-FPM attack surface: If nginx + PHP-FPM is in use, ensure the
fastcgi_split_path_infodirective is properly configured. CVE-2019-11043 exploits a specific nginx configuration flaw. Refer to the PHP advisory for hardening guidance. - Disable IMAP functions if unused: CVE-2018-19518 requires
imap_open()to be invoked with attacker-controlled server names. If IMAP functionality is not required by the application, disable the PHP IMAP extension entirely (extension=imap.so→ remove or comment out). - Deploy network detection: Monitor for HTTP requests containing
%0a(newline) characters in URL paths and for any outbound connections from the Fuel-Boss host to unexpected IPs — indicators of CVE-2019-11043 exploitation and post-exploitation C2.
Shield53 Recommendations
- Treat this as a supply chain governance failure, not just a patching task. Add PHP runtime version verification to your ICS vendor risk assessment checklist. Any vendor still on PHP 7.1 in 2026 should trigger an immediate escalation.
- For Master/Slave and Backflush variants with no fix: Implement compensating controls per NIST SP 800-82 Rev. 3 — network segmentation, application allowlisting, and continuous integrity monitoring. Document the risk acceptance formally.
- Pressure the vendor: Organizations running the unpatched variants should formally request remediation timelines from All-Line Equipment Company and, if responses are inadequate, consider filing a report with CISA's ICS vendor coordination process.
- Plan for runtime replacement: If All-Line cannot provide a path off PHP 7.1, begin evaluating alternative fuel management platforms. Running unsupported runtime environments in safety-critical infrastructure is an unacceptable long-term posture.
