CVE-2023-49897 · netVigilance record NV23-0187

FXC AE1021, AE1021PE OS Command Injection

past due

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA deadline 2024-01-11 · passed 2 years 7 months ago · applies to US federal civilian agencies; used elsewhere as a reference SLA

What happened

FXC AE1021 and AE1021PE contain an OS command injection vulnerability that allows authenticated users to execute commands via a network.

Who is affected

FXC AE1021, AE1021PE. Affected version ranges are listed in the vendor advisory and the NVD entry linked under Sources.

Weakness class: CWE-78.

Timeline

2023-12-21
Added to CISA KEVExploitation in the wild confirmed by CISA
2024-01-11
CISA remediation deadlinepassed 2 years 7 months ago

Sources

NVD entry for CVE-2023-49897 nvd.nist.gov/vuln/detail/CVE-2023-49897
CISA Known Exploited Vulnerabilities catalog www.cisa.gov/known-exploited-vulnerabilities-catalog
fxc.jp www.fxc.jp/news/20231206
nvd.nist.gov nvd.nist.gov/vuln/detail/CVE-2023-49897