CVE-2023-49897
An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and...
An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
- Record
CVE-2023-49897- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
CVE List
An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
- Record
CVE-2023-49897- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2023-53797
An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
- Record
EUVD-2023-53797- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-x3f3-j7qh-9wgj
An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and...
An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
- Record
GHSA-x3f3-j7qh-9wgj- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
CISA KEV No score
FXC AE1021, AE1021PE OS Command Injection Vulnerability
FXC AE1021 and AE1021PE contain an OS command injection vulnerability that allows authenticated users to execute commands via a network.
- Record
CVE-2023-49897- Weakness
- CWE-78
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-49897 is a high vulnerability (CVSS 8.8) in Fxc Ae1021 Firmware, published December 6, 2023. CISA lists it as known to be exploited, since December 21, 2023. EUVD reports exploitation since December 21, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 50.4%, the 98th percentile. No source names a fixed version.
References
fxc.jp/news/20231206
jvn.jp/en/vu/JVNVU92152057
cisa.gov/news-events/ics-advisories/icsa-23-355-01
akamai.com/blog/security-research/zero-day-vulnerability-spreading-mirai-patched
nvd.nist.gov/vuln/detail/CVE-2023-49897
github.com/advisories/GHSA-x3f3-j7qh-9wgj