Argument injection through imap_open() needs a chain, and the chain is short. The application passes a hostname it does not control into the function. On the host, rsh has been replaced by a program with different argument semantics, typically ssh. A server name carrying a "-oProxyCommand" argument then becomes an OS command [2]. The defective component is the University of Washington IMAP Toolkit 2007f as reached through PHP, and CISA files it as CWE-88 [2][10].
The second bug is conditional. CISA's text says certain FPM configurations let the module write past allocated buffers into space reserved for FCGI protocol data, creating a remote code execution condition, filed as CWE-120 [3][10]. Whether a given Fuel-Boss install runs that configuration is not something the advisory tells you, and that is the difference between a live path and a paper finding.
The remediation arithmetic is worth doing. Four product lines are listed [1]. Fixes exist for two of them, V1 Standard and V1 Portal, distributed by calling All-Line on 866-356-3336 [6]. That leaves half the listed lines with no fix in hand, and one line in four, Backflush Systems, with none planned at all [2]. Master/Slave has a fix pending and no date attached [6]. The vendor's own answer for the rest is to pull unfixed products off the internet or restrict access by source IP at the router [7].
The field that matters most here is the version field. It reads PHP_7.1.5_7.1.5, not a Fuel-Boss build number [1]. An inventory keyed to product versions returns nothing against this advisory, because the vulnerable component is the runtime the product carries. Both CVE identifiers were assigned in 2018 and 2019 while the advisory sits in CISA's 26 series, putting the bugs at eight and seven years old by identifier year alone [1]. Neither was secret in the interval. What was missing was a record of which ICS product embedded that runtime, and CISA lists this one as deployed worldwide across critical manufacturing, the defense industrial base, emergency services and transportation systems [5].
On exploitability, the advisory says less than operators will want. The vulnerabilities were reported to CISA anonymously, and the document carries no statement of known exploitation against Fuel-Boss [8]. CISA's standing control-system guidance is the usual set: keep the systems off the internet, put them behind firewalls isolated from business networks, and where remote access is required use VPNs while accepting that VPNs have their own vulnerabilities [9]. For Standard and Portal owners the work is a phone call plus a verification problem, because the advisory names no fixed version string to check the result against [6]. Successful exploitation, per CISA, is arbitrary command or code execution on the affected system [4].
