Critical RCE Vulnerabilities in Fuel-Boss Devices Leave Industrial Systems Exposed
Multiple critical vulnerabilities in All-Line Equipment Company's Fuel-Boss fuel management devices allow remote attackers to execute arbitrary commands or code, posing serious risks to industrial and operational technology environments. Compounding the issue, patches are only available for two of the four affected product variants, leaving Master/Slave and Backflush System users without an official fix. Unpatched internet-facing OT/ICS devices are high-value targets for threat actors seeking to disrupt critical infrastructure or cause physical damage. The absence of a universal patch underscores the dangers of legacy and end-of-life industrial devices remaining connected to networks without compensating controls.
Tactical Insight
Immediate actions
- Apply available patches immediately for V1 Standard and V1 Portal versions and monitor vendor channels for fixes covering Master/Slave and Backflush Systems.
- Isolate all Fuel-Boss devices from the public internet and place them behind industrial demilitarized zones (DMZs) or air-gapped segments.
- Audit all network-facing fuel management devices and remove any unnecessary remote access exposures.
Long-term improvements
- Maintain a comprehensive, up-to-date inventory of all OT/ICS assets, including firmware versions and patch status, to enable rapid response to future disclosures.
- Establish a formal OT/ICS vulnerability management program with defined SLAs for critical severity findings.
- Develop vendor lifecycle policies that mandate migration or compensating controls when products reach end-of-support status.
Detection measures
- Deploy network monitoring and anomaly detection tools tuned for OT protocols to identify unauthorized command execution attempts targeting Fuel-Boss devices.
- Enable centralized logging for all access attempts to industrial control devices and alert on unusual authentication or command activity.
- Subscribe to CISA ICS advisories and integrate them into your threat intelligence workflow for proactive notification of future disclosures.