CVE-2023-49897
HighActively exploited (CISA KEV)
Description
An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
SeverityHigh
CVSS8.8
Exploit probability—
ProductFXC AE1021, AE1021PE
PublishedDec 6, 2023
First seenDec 6, 2023
Added to KEVDec 21, 2023
Weakness typeCWE-78OS command injection
How to fix
CISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date: Jan 11, 2024Update
- fxc ae1021_firmware2.0.10 or later
- fxc ae1021pe_firmware2.0.10 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fxc ae1021_firmware | v < 2.0.10 | 2.0.10 |
| fxc ae1021pe_firmware | v < 2.0.10 | 2.0.10 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.