Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2023-49897

An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier.

Affects AE1021PE and AE1021 firmware 2.0.9 and earlier, reached through NTP server settings. CVSS rates it 8.8 (high); no vendor rating or fixed version is listed in the checked facts.

Published
Last modified
published
Listed in CISA KEV
Actively exploited
None on Exploit-DB, Metasploit or GitHub

Summary

The software affected is the firmware for the AE1021 and AE1021PE products. An attacker who is able to log in to the device could exploit this flaw to run arbitrary operating system commands on it.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

Timeline

  1. CVE published
  2. Added to CISA KEV

    CISA has evidence of exploitation in the wild

  3. CISA remediation deadline

    Due date for US federal agencies to patch

  4. Record last updated
  5. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • FXC Inc. AE1021PE

    2.0.9 and earlier

  • FXC Inc. AE1021

    2.0.9 and earlier

References 4

fxc.jp

jvn.jp

cisa.gov

akamai.com

FAQ

Questions about CVE-2023-49897

What does this mean?

An attacker who can log in to the product can run arbitrary operating system commands, which gives remote code execution on the device.Source: cisa.gov, jvn.jp

Am I affected, and how do I check?

AE1021PE and AE1021 firmware version 2.0.9 and earlier are listed as affected. The flaw is reached through the NTP server settings, so check the firmware version on the device and whether those settings are in use.Source: cisa.gov, jvn.jp

What should I do about it?

No fixed firmware version is listed in the checked facts, so no upgrade target can be stated here. Follow the vendor's advisory for the release that addresses this issue.Source: cisa.gov, jvn.jp

Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-12-21, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data

What if there's no patch?

Reset the device to "Factory setting" and change the default management screen login password, since the attacker must be able to log in. Limiting access to the management screen also reduces exposure.Source: cisa.gov, jvn.jp