FXC AE1021, AE1021PE OS Command Injection Vulnerability

HIGH 8.8EXPLOITED (CISA KEV)CVE-2023-49897 · Published 06/12/2023 · updated 17/06/2026

FXC AE1021, AE1021PE OS Command Injection Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 21/12/2023. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
AE1021, AE1021PE FXC	Versions not published yet (product named by CISA KEV)

Description

An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

References

jvn.jp/en/vu/JVNVU92152057 · Third Party Advisory
akamai.com/blog/security-research/zero-day-vulnerability-spreading-mirai-patched · Exploit
cisa.gov/news-events/ics-advisories/icsa-23-355-01 · Third Party Advisory
fxc.jp/news/20231206 · Release Notes
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2023-49897

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free