All-Line Equipment Company Fuel-Boss

A vulnerability exists in All-Line Equipment Company's Fuel-Boss industrial control system software, specifically versions up to and including PHP 7.1.5. Exploitation could allow remote code execution by injecting a malicious argument into the IMAP server name. While fixes are available for the Fuel-Boss V1 Standard and Fuel-Boss V1 Portal, no fix is currently planned for the Fuel-Boss V1 Master/Slave, and no fix is planned for Fuel-Boss V1 Backflush Systems. Mitigation strategies include removing unpatched devices from the internet and restricting access at the router level.