CVE-2023-49897highunder attackCWE-78

CVE-2023-49897: high-severity vulnerability in FXC Inc. AE1021

Published · Updated

Follow this CVE+ Monitor AE1021+ Monitor AE1021PE

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8.8epss 50%
from disclosure to weapon
Published on NVDDec 6
CISA KEV+15d
Action required by CISAfederal deadline: 2024-01-11

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

A flaw in AE1021PE and AE1021 device firmware allows someone with login access to run unauthorized system commands on the device. This could let them take complete control of the device and access sensitive data.

Technical detail

OS command injection vulnerability in AE1021PE and AE1021 firmware ≤2.0.9 allows authenticated attackers to execute arbitrary OS commands through unsanitized input. Attack requires valid credentials and affects system integrity and confidentiality.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
FXC Inc. · AE1021FXC Inc. · AE1021PE
Related CVEs — FXC Inc. AE1021

In the same product, most dangerous first.

CVE-2024-53688HIGHCVE-2024-53688EPSS 1.6%CVE-2024-54457HIGHCVE-2024-54457EPSS 0.4%CVE-2024-47397HIGHCVE-2024-47397EPSS 0.4%