CVE-2019-11043 is a buffer overflow (CWE-120) in PHP's FastCGI Process Manager that lets a remote, unauthenticated attacker write past allocated buffers to potentially execute arbitrary code; it is in the CISA Known Exploited Vulnerabilities catalog, and on 2026-08-27 CISA republished it as part of ICS advisory ICSA-26-239-02 because All-Line Equipment Company's Fuel-Boss fuel terminal management system bundles a vulnerable PHP 7.1.5 build that the vendor has only partially patched.
Vulnerability summary
9.8
Critical
99.8%
EPSS score (FIRST)
Yes
CISA KEV catalog
2019-10-28
Published
Vulnerability ID: CVE-2019-11043 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| All-Line Equipment Company Fuel-Boss V1 (Standard, Portal, Master/Slave, Backflush) fuel management system | — | Fuel-Boss V1 Standard, Portal, Master/Slave and Backflush variants running PHP 7.1.5 in vulnerable FPM configurations (per CISA advisory ICSA-26-239-02); vendor patches available for the Standard and Portal versions only |
What this means
CVE-2019-11043 is a Buffer Overflow vulnerability (CWE-120, called out as Classic Buffer Overflow in NVD's weakness field) in PHP's FastCGI Process Manager (FPM). NVD's analysis (status "Analyzed") gives an NVD-confirmed Primary CVSS v3.1 base score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, describing the flaw generically: "In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution" (NVD).
CISA added CVE-2019-11043 to the Known Exploited Vulnerabilities (KEV) catalog on 2022-03-25 as the "PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability"; a public proof-of-concept exploit (phuip-fpizdam) has circulated since 2019 (CISA KEV).
Seven-year-old PHP bugs don't stay confined to web servers: on 2026-08-27 CISA republished this CVE as part of ICS advisory ICSA-26-239-02, because All-Line Equipment Company's Fuel-Boss V1 fuel terminal management system — which tracks and controls fuel dispensing, records transactions, and accepts USB/manual-override data at bulk plants and convenience-store fuel racks — runs PHP 7.1.5 in a vulnerable FPM configuration. In that product-specific context, NVD records a Secondary CVSS v3.1 rating of 8.7 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) and CVSS v4.0 9.4 (critical), submitted by CISA's ICS-CERT coordinator, reflecting a scope change and higher attack complexity than the generic PHP rating; this page keeps the NVD Primary 9.8 as the headline score since that is the NVD-confirmed rating. The advisory covers the Critical Manufacturing, Defense Industrial Base, Emergency Services and Transportation Systems sectors with worldwide deployment, and the issue was reported anonymously. CISA's advisory also lists a companion CVE affecting the same product, CVE-2018-19518 (CWE-88 argument injection via PHP's imap_open(), NVD Primary CVSS v3.1 7.5), which the vendor's Standard and Portal patches also address (CISA ICS Advisory ICSA-26-239-02, NVD).
All-Line Equipment Company's own Fuel-Boss product pages describe the system's fuel-tracking and transaction-recording features but carry no public security-advisory page; CISA's ICS advisory states the vendor "offers patches for Standard and Portal versions only" and, for unpatched Master/Slave and Backflush variants, recommends taking the devices off the internet or restricting access by IP address at the router level (Fuel-Boss, CISA ICS Advisory ICSA-26-239-02).
As of 2026-10-31, FIRST scores the probability of exploitation at 0.99783 (99.96th percentile) — among the highest EPSS scores observed in this corpus, consistent with a KEV-listed bug with a public exploit tool. Companion CVE-2018-19518 similarly scores 0.96107 (99.88th percentile) (FIRST EPSS).
Operators running Fuel-Boss Standard or Portal should apply the vendor's patch immediately; those on Master/Slave or Backflush variants without a patch should isolate the device from the internet and restrict access to trusted IP addresses at the router, since this is a KEV-listed, near-certainly-targeted vulnerability sitting on equipment that controls physical fuel dispensing.
Evidence
- PHP FPM buffer overflow (CWE-120) lets a remote attacker write past allocated buffers into FCGI protocol data space, opening the possibility of remote code execution; NVD Primary CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, status Analyzed. — NVD
- Added to the CISA Known Exploited Vulnerabilities catalog on 2022-03-25 as the "PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability." — CISA KEV
- Republished on 2026-08-27 as ICSA-26-239-02 because All-Line Equipment Company's Fuel-Boss V1 fuel terminal management system bundles vulnerable PHP 7.1.5; product-context NVD Secondary CVSS v3.1 8.7/v4.0 9.4 submitted by CISA ICS-CERT; covers Critical Manufacturing, Defense Industrial Base, Emergency Services and Transportation Systems sectors worldwide; companion CVE-2018-19518 (argument injection) also bundled; reported anonymously. — CISA ICS Advisory ICSA-26-239-02
- Vendor offers patches for Fuel-Boss Standard and Portal versions only; unpatched Master/Slave and Backflush variants should be taken off the internet or restricted by IP address at the router level. — CISA ICS Advisory ICSA-26-239-02
- EPSS score is 0.99783 (99.96th percentile) as of 2026-10-31. — FIRST EPSS
