What’s Vulnerable › Vulnerabilities

CVE-2023-49897: FXC AE1021, AE1021PE OS Command Injection Vulnerability

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2023-12-21
• EPSS: 50.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-12-06 · updated 2026-06-17
• Weakness: CWE-78

Description

An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

Affected products

• Fxc Ae1021 Firmware: before 2.0.10 — fixed in 2.0.10
• Fxc Ae1021Pe Firmware: before 2.0.10 — fixed in 2.0.10

How to fix

Upgrade to a fixed version: Fxc Ae1021 Firmware 2.0.10; Fxc Ae1021Pe Firmware 2.0.10. Check the vendor advisory for mitigations.

References

• https://jvn.jp/en/vu/JVNVU92152057/
• https://www.akamai.com/blog/security-research/zero-day-vulnerability-spreading-mirai-patched
• https://www.cisa.gov/news-events/ics-advisories/icsa-23-355-01
• https://www.fxc.jp/news/20231206
• https://jvn.jp/en/vu/JVNVU92152057/
• https://www.akamai.com/blog/security-research/zero-day-vulnerability-spreading-mirai-patched
• https://www.cisa.gov/news-events/ics-advisories/icsa-23-355-01
• https://www.fxc.jp/news/20231206
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-49897

Get alerted when CVE-2023-49897 or the next vulnerability affects your stack