CISA Advisory: Critical Vulnerabilities in All-Line Equipment Company Fuel-Boss

CISA released an advisory detailing two critical vulnerabilities in All-Line Equipment Company Fuel-Boss, a fuel management system used in critical infrastructure sectors. The vulnerabilities, CVE-2018-19518 and CVE-2019-11043, affect Fuel-Boss V1 Standard, Portal, Master/Slave, and Backflush Systems running PHP 7.1.5. Successful exploitation could allow remote attackers to execute arbitrary commands or code. Fixes are available for Standard and Portal versions, but not yet for Master/Slave, and no fix is planned for Backflush Systems. CISA recommends taking affected products offline or restricting network access.