CVE-2018-19518

highpriority · attend · 74EPSS 0.961 · 100 %ileexploit · functionalDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

4 exploits · functional

Likely / severe?

96.1% (100th) EPSS

CVSS 8.5 · high

Is it mine?

37 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-27

University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedfesto_psirt
FactoryViews (non-Lite): Upgrade to FactoryViews 1.6.0. See the upgrade guide for information on how to upgrade. FactoryViews Lite: Upgrade to FactoryViews 1.7.0. See the upgrade guide for information on how to upgrade.
FixedMES PCfesto_psirt
Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.
FixedMES PCcisa_csaf_ot
Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.
FixedFuel-Boss V1 Backflush Systemscisa_csaf_ot
No fix is planned for Fuel-Boss V1 Backflush Systems.
FixedFuel-Boss V1 Master/Slavecisa_csaf_ot
Fixes are not yet available for the Fuel-Boss V1 Master/Slave.
FixedFuel-Boss V1 Portalcisa_csaf_ot
Fixes are available for the Fuel-Boss V1 Standard and Fuel-Boss V1 Portal. Please contact All-Line Equipment Company (866-356-3336) for instructions on how to receive these fixes.
FixedFuel-Boss V1 Standardcisa_csaf_ot
Fixes are available for the Fuel-Boss V1 Standard and Fuel-Boss V1 Portal. Please contact All-Line Equipment Company (866-356-3336) for instructions on how to receive these fixes.
MitigationFuel-Boss V1 Backflush Systemscisa_csaf_ot
All-Line Equipment Company recommends either taking products that are not fixed off the Internet or restricting the IP addresses that can access them at the router level.
MitigationFuel-Boss V1 Master/Slavecisa_csaf_ot
All-Line Equipment Company recommends either taking products that are not fixed off the Internet or restricting the IP addresses that can access them at the router level.
MitigationFuel-Boss V1 Portalcisa_csaf_ot
All-Line Equipment Company recommends either taking products that are not fixed off the Internet or restricting the IP addresses that can access them at the router level.
MitigationFuel-Boss V1 Standardcisa_csaf_ot
All-Line Equipment Company recommends either taking products that are not fixed off the Internet or restricting the IP addresses that can access them at the router level.

cvss

Technical severity, 0–10. One row per scoring source.

8.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.08.5highAV:N/AC:M/Au:S/C:C/I:C/A:Cprimary · NVD / NIST USexploitability 6.8 · impact 10

v3.17.5highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 1.6 · impact 5.9

v3.17.5highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US

v3.17.5highAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · Festo PSIRT DE

v3.17.5highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-88USprimaryCWE-78USCWE-88USCWE-88US

exploits (4)

Public proof-of-concept and weaponised exploit code.

EDB-45914PHP imap_open - Remote Code Execution (Metasploit)functional · exploit_db
exploit/linux/http/php_imap_open_rcephp imap_open Remote Code Executionfunctional · metasploit
ensimag-security/CVE-2018-19518some works on CVE-2018-19518 PoC · poc_in_github
houqe/EXP_CVE-2018-19518houqe/EXP_CVE-2018-19518PoC · poc_in_github

affected products (37)

Products and version ranges known to be affected.

All-Line Equipment Company Fuel-Boss V1 Backflush Systems: >=|<=PHP_7.1.5_7.1.5all versionscisa_csaf_otUS
All-Line Equipment Company Fuel-Boss V1 Master/Slave: >=|<=PHP_7.1.5_7.1.5all versionscisa_csaf_otUS
All-Line Equipment Company Fuel-Boss V1 Portal: >=|<=PHP_7.1.5_7.1.5all versionscisa_csaf_otUS
All-Line Equipment Company Fuel-Boss V1 Standard: >=|<=PHP_7.1.5_7.1.5all versionscisa_csaf_otUS
All-Line Equipment Company Fuel-Boss V1 Backflush Systems| → PHP_7.1.5_7.1.5cisa_csaf_otUS
All-Line Equipment Company Fuel-Boss V1 Master/Slave| → PHP_7.1.5_7.1.5cisa_csaf_otUS
All-Line Equipment Company Fuel-Boss V1 Portal| → PHP_7.1.5_7.1.5cisa_csaf_otUS
All-Line Equipment Company Fuel-Boss V1 Standard| → PHP_7.1.5_7.1.5cisa_csaf_otUS
n/a n/a≤ n/aenisa_euvdEU
FactoryViews 1.6.0all versionsfixedfesto_psirtDEcpe:2.3:a:festo:factory_views_software:1.6.0:*:*:*:*:*:*:*
FactoryViews 1.7.0all versionsfixedfesto_psirtDEcpe:2.3:a:festo:factory_views_software:1.7.0:*:*:*:*:*:*:*
Festo FactoryViews≤ vers:semver/<1.6.0festo_psirtDE
Festo FactoryViews <1.6.0≤ vers:semver/<1.6.0festo_psirtDE
Festo FactoryViews Lite≤ vers:generic/<=1.1festo_psirtDE
Festo FactoryViews Lite <=1.1≤ vers:generic/<=1.1festo_psirtDE
Festo Didactic SE Festo Didactic SE MES PC shipped with Windows 10all versionsfesto_psirtDE
Festo Didactic SE MES PCall versionsfesto_psirtDE
PHP Group PHP≤ 7.1.25fstec_bduRU
PHP Group PHP≤ 7.3.0fstec_bduRU
PHP Group PHP≤ 7.2.13fstec_bduRU

showing 20 of 37

advisories (4)

Vendor and ecosystem advisories describing this.

FSA-202302Festo: Several vulnerabilities in FactoryViews2023-07-10csaf · festo_psirtDE
FactoryViews bundles many third-party applications which are used in background processes to provide the software's features. From time to time, vulnerabilities in these bundled applications are discovered. These are typically fixed in newer versions of FactoryViews by updating the bundled applications. FactoryViews versions up to and including 1.5.2 contain around 200 such vulnerabilities listed in this advisory.Version 1.6.0 is a security rollup release which includes updates to all bundled applications and fixes these vulnerabilities. At this time, FactoryViews Lite cannot be updated beyond version 1.1. FactoryViews 1.7 unifies the non-Lite and Lite versions and fixes these vulnerabilities for users of FactoryViews Lite.
FSA-202402Several Vulnerabilities in MES PC (Windows 10)2024-02-27csaf · festo_psirtDE
MES PCs shipped with Windows 10 come pre-installed with XAMPP. XAMPP is a bundle of third-party open-source applications including the Apache HTTP Server, the MariaDB database and more. From time to time, vulnerabilities in these applications are discovered. These are fixed in newer versions of XAMPP by updating the bundled applications. MES PCs shipped with Windows 10 include a copy of XAMPP which contains around 140 such vulnerabilities listed in this advisory. They can be fixed by replacing XAMPP with Festo Didactic's Factory Control Panel application.
ICSA-26-027-02Festo Didactic SE MES PC2024-02-27icsa · cisa_csaf_otUS
MES PCs shipped with Windows 10 come pre-installed with XAMPP. XAMPP is a bundle of third-party open-source applications including the Apache HTTP Server, the MariaDB database and more. From time to time, vulnerabilities in these applications are discovered. These are fixed in newer versions of XAMPP by updating the bundled applications. MES PCs shipped with Windows 10 include a copy of XAMPP which contains around 140 such vulnerabilities listed in this advisory. They can be fixed by replacing XAMPP with Festo Didactic's Factory Control Panel application.
ICSA-26-239-02All-Line Equipment Company Fuel-Boss2026-08-27icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow attackers to execute arbitrary commands or code remotely on affected systems.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot festo_psirt NVD CVE.org MITRE

published 2018-11-25modified 2026-06-17

related (592)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-86060US	critical9.8OT critical	6.39% (94th)	KEV	2026-09-05
RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be ch…
CVE-2026-24061US	—OT critical	99.0% (100th)	KEV	2026-01-21
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
CVE-2024-41710US	high7.2OT critical	41.6% (99th)	KEV	2024-08-12
A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated…
CVE-2024-4577US	critical9.8OT critical	100.0% (100th)	KEV	2024-06-09
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows m…
CVE-2022-36804US	high8.8OT critical	99.1% (100th)	KEV	2022-08-25
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21…

+587 more

references (70)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan