CVE-2023-49897
FXC AE1021, AE1021PE OS Command Injection Vulnerability
Description
CVE-2023-49897 is an OS command injection vulnerability affecting FXC AE1021PE firmware version 2.0.9 and earlier and FXC AE1021 firmware version 2.0.9 and earlier. The flaw is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning that user-supplied input is passed unsanitized to an underlying operating system shell. An authenticated attacker with network access to the device can exploit CVE-2023-49897 to execute arbitrary operating system commands, potentially resulting in full device compromise. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, and active exploitation spreading Mirai botnet variants has been publicly documented, making rapid remediation critical.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| fxc | ae1021 firmware | < 2.0.10 |
| fxc | ae1021pe firmware | < 2.0.10 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://jvn.jp/en/vu/JVNVU92152057/(Third Party Advisory)
- https://www.akamai.com/blog/security-research/zero-day-vulnerability-spreading-mirai-patched(Exploit, Third Party Advisory)
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-355-01(Third Party Advisory, US Government Resource)
- https://www.fxc.jp/news/20231206(Release Notes, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-49897(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements Used in an OS Command (OS Command Injection)
CVE-2023-49897 results from improper neutralization of user-controlled input before it is used in OS-level command execution within the FXC AE1021/AE1021PE firmware. When an authenticated user submits crafted input containing shell metacharacters or command separators, the firmware passes this input directly to the operating system shell, executing arbitrary commands in the device context.
Learn more: CWE-78 — Improper Neutralization of Special Elements Used in an OS Command
Impact Analysis
CVE-2023-49897 has a CVSS v3.1 base score of 8.8 (HIGH). The attack vector is Network, allowing exploitation over the internet or local network. Attack complexity is Low, and Low privileges are required (authenticated access), with no user interaction needed beyond the attacker’s own login session.
Confidentiality Impact: High — An attacker can read any data on the device, including credentials, configuration, and network traffic.
Integrity Impact: High — Arbitrary OS commands allow modification of device configuration, firmware, or files.
Availability Impact: High — The attacker can disrupt or disable the device, deny service, or enroll it into a botnet.
Public reports link CVE-2023-49897 to active exploitation by Mirai botnet operators, who use compromised routers as DDoS infrastructure. The EPSS score of 0.336 (97th percentile) indicates an exceptionally high real-world exploitation probability.
Exploit Maturity
CVE-2023-49897 is actively exploited in the wild. CISA included it in the Known Exploited Vulnerabilities (KEV) catalog with a remediation due date of January 11, 2024. Security researchers at Akamai documented zero-day exploitation of this vulnerability prior to patch availability, with threat actors deploying Mirai botnet variants on compromised FXC router devices. The EPSS score of 0.336 places this CVE in the 97th percentile, indicating a very high exploitation probability relative to all published CVEs. Ransomware association is listed as Unknown.
Remediation
- Update the FXC AE1021 and AE1021PE firmware to a version later than 2.0.9, as released by FXC. The vendor published patched firmware on December 6, 2023 (see fxc.jp/news/20231206).
- Restrict network access to the device management interface using firewall rules or VLANs — limit access to trusted administrative IP ranges only.
- Change default credentials on all FXC AE1021/AE1021PE devices immediately, even on patched firmware, as a defense-in-depth measure.
- Monitor for indicators of compromise — Mirai-infected devices often exhibit anomalous outbound traffic (high UDP/TCP traffic volumes to unusual destinations).
- Apply mitigations per vendor instructions as required by the CISA KEV catalog, or discontinue use of the product if mitigations are unavailable.
- Consult the CISA ICS Advisory (ICSA-23-355-01) for additional guidance specific to this industrial/SOHO router vulnerability.
Technical Details
CVE-2023-49897 is an OS command injection vulnerability (CWE-78) in the web management interface of FXC AE1021 and AE1021PE wireless router firmware versions 2.0.9 and earlier.
Attack mechanism: The firmware fails to adequately sanitize input parameters before passing them to underlying OS shell commands. An attacker who can authenticate to the router’s management interface (requiring only low-privilege credentials) can inject shell metacharacters into affected parameters, causing the device to execute arbitrary OS commands with the privileges of the web server or router firmware process.
Exploitation context: According to Akamai research, this vulnerability was exploited as a zero-day before a patch was available, with attackers deploying Mirai botnet payloads that turn compromised routers into DDoS amplification agents. The network-accessible management interface means the attack surface is broad for any internet-facing device.
Affected firmware: FXC AE1021PE firmware ≤ 2.0.9, FXC AE1021 firmware ≤ 2.0.9. Fixed firmware was released by FXC on December 6, 2023.
Frequently Asked Questions
What is CVE-2023-49897?
CVE-2023-49897 is an OS command injection vulnerability in FXC AE1021 and AE1021PE router firmware versions 2.0.9 and earlier. An authenticated attacker with network access can exploit the flaw to execute arbitrary operating system commands on the affected device.
Is CVE-2023-49897 being actively exploited?
Yes. Security researchers documented active zero-day exploitation of CVE-2023-49897 before a patch was available, with Mirai botnet variants being deployed on compromised devices. CISA confirmed exploitation by adding this CVE to the KEV catalog with a January 11, 2024 remediation deadline.
Which products are affected by CVE-2023-49897?
FXC AE1021PE firmware version 2.0.9 and earlier, and FXC AE1021 firmware version 2.0.9 and earlier, are affected. FXC released patched firmware on December 6, 2023.
How do I fix CVE-2023-49897?
Update the firmware of all FXC AE1021 and AE1021PE devices to a version released after December 6, 2023. Additionally, restrict management interface access to trusted IP addresses only to reduce the attack surface even on patched devices.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.