Actively exploited · Published Dec 6, 2023 · Assigned by jpcert
CVE-2023-49897
High 8.8 Exploited
In plain English
A high-severity OS command injection in AE1021 from FXC Inc.. Attackers are actively exploiting it in the wild (listed by CISA on December 21, 2023). The chance it is exploited in the next 30 days is estimated at 50.4% (higher than 99% of all known vulnerabilities). Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Jan 11, 2024.
Official description
An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://www.fxc.jp/news/20231206
- https://jvn.jp/en/vu/JVNVU92152057/
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-355-01
- https://www.akamai.com/blog/security-research/zero-day-vulnerability-spreading-mirai-patched
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-49897 government-resource