High severity · published Dec 6, 2023
CVE-2023-49897
FXC AE1021, AE1021PE OS Command Injection Vulnerability
In wildKEV
8.8
CVSS
50.4%
EPSS
Yes
On KEV
Description
An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)50.4% · higher than 99% of CVEs
Exploited in the wildYes
CISA KEVListed Dec 21, 2023
Federal remediation dueJan 11, 2024
Ransomware campaign useNot known
Affected products
Which versions
AE
AE1021 · FXC Inc.
2.0.9 and earlier · source: vendor
AE
AE1021PE · FXC Inc.
2.0.9 and earlier · source: vendor
AF
Ae1021 Firmware · Fxc
before 2.0.10 · source: NVD
AF
Ae1021pe Firmware · Fxc
before 2.0.10 · source: NVD
AA
AE1021, AE1021PE · FXC
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-49897
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-49897
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
www.fxc.jp
https://www.fxc.jp/news/20231206
jvn.jp
https://jvn.jp/en/vu/JVNVU92152057/
www.cisa.gov
https://www.cisa.gov/news-events/ics-advisories/icsa-23-355-01
www.akamai.com
https://www.akamai.com/blog/security-research/zero-day-vulnerability-spreading-mirai-patched
More from AE1021
7.5
CVE-2024-47397
Weak authentication issue exists in AE1021 firmware versions 2.0.10 and earlier and AE1021PE firmware versions 2.0.10 and earlier
7.2
CVE-2024-54457
Inclusion of undocumented features or chicken bits issue exists in AE1021 firmware versions 2.0.10 and earlier and AE1021PE firmware versions 2.0.10 and earlier, which may allow a…
7.2
CVE-2024-53688
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in AE1021 firmware versions 2.0.10 and earlier and AE1021PE firmware…