CVE-2023-49897

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
FXC Inc.	AE1021PE	2.0.9 and earlier
FXC Inc.	AE1021	2.0.9 and earlier

References

https://jvn.jp/en/vu/JVNVU92152057/Third Party Advisory
https://www.akamai.com/blog/security-research/zero-day-vulnerability-spreading-mirai-patchedExploit, Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-23-355-01Third Party Advisory, US Government Resource
https://www.fxc.jp/news/20231206Release Notes, Vendor Advisory
https://jvn.jp/en/vu/JVNVU92152057/Third Party Advisory
https://www.akamai.com/blog/security-research/zero-day-vulnerability-spreading-mirai-patchedExploit, Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-23-355-01Third Party Advisory, US Government Resource
https://www.fxc.jp/news/20231206Release Notes, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-49897US Government Resource

Timeline

Published: Dec 6, 2023
Last modified: Jun 17, 2026
Added to CISA KEV: Dec 21, 2023
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-498987.2In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation param CVE-2023-498999.8An unauthenticated remote attacker can execute any command on the affected device due to not correctly verifying the origin of a communicati CVE-2023-49907.5Directory traversal vulnerability in MCL-Net versions prior to 4.6 Update Package (P01) may allow attackers to read arbitrary files.CVE-2023-499009.8An unauthenticated remote attacker is able to perform remote code execution due to incorrectly sanitized user input in the SetParameter comm CVE-2023-499068.8A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gi CVE-2023-499078.8A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gi CVE-2023-499088.8A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gi CVE-2023-499098.8A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gi CVE-2023-49917.8A vulnerability was found in NextBX QWAlerter 4.50. It has been rated as critical. Affected by this issue is some unknown functionality of t CVE-2023-499108.8A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gi CVE-2023-499118.8A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gi CVE-2023-499128.8A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gi