CVE-2023-49897
high · 8.8Actively exploitedOn the CISA Known Exploited Vulnerabilities catalog
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Added 2023-12-21Remediation due 2024-01-11
An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
8.8
CVSS
50.4%
EPSS (exploit prob.)
99th
EPSS percentile
2023-12-06
Published
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| fxc | ae1021_firmware | < 2.0.10 |
| fxc | ae1021 | all versions |
| fxc | ae1021pe_firmware | < 2.0.10 |
| fxc | ae1021pe | all versions |
Check a specific version with /api/v1/cve/match.
References
- https://jvn.jp/en/vu/JVNVU92152057/
- https://www.akamai.com/blog/security-research/zero-day-vulnerability-spreading-mirai-patched
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-355-01
- https://www.fxc.jp/news/20231206
- https://jvn.jp/en/vu/JVNVU92152057/
- https://www.akamai.com/blog/security-research/zero-day-vulnerability-spreading-mirai-patched
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-355-01
- https://www.fxc.jp/news/20231206
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-49897
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2023-49897