CVE-2023-49897

An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://jvn.jp/en/vu/JVNVU92152057/	Third Party Advisory
https://www.akamai.com/blog/security-research/zero-day-vulnerability-spreading-mirai-patched	Exploit Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-23-355-01	Third Party Advisory US Government Resource
https://www.fxc.jp/news/20231206	Release Notes Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:fxc:ae1021_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:fxc:ae1021:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:fxc:ae1021pe_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:fxc:ae1021pe:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-12-06 07:15

Updated : 2024-06-11 01:16

NVD link : CVE-2023-49897

Mitre link : CVE-2023-49897

CVE.ORG link : CVE-2023-49897

JSON object : View

Products Affected

fxc

ae1021_firmware
ae1021pe
ae1021
ae1021pe_firmware

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2023-49897", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2023-12-06T07:15:41.883", "references": [{"url": "https://jvn.jp/en/vu/JVNVU92152057/", "tags": ["Third Party Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "https://www.akamai.com/blog/security-research/zero-day-vulnerability-spreading-mirai-patched", "tags": ["Exploit", "Third Party Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-355-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "vultures@jpcert.or.jp"}, {"url": "https://www.fxc.jp/news/20231206", "tags": ["Release Notes", "Vendor Advisory"], "source": "vultures@jpcert.or.jp"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product."}, {"lang": "es", "value": "Existe una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo en la versi\u00f3n 2.0.9 y anteriores del firmware AE1021PE y en la versi\u00f3n 2.0.9 y anteriores del firmware AE1021. Si se explota esta vulnerabilidad, un atacante puede ejecutar un comando arbitrario del sistema operativo que pueda iniciar sesi\u00f3n en el producto."}], "lastModified": "2024-06-11T01:16:50.817", "cisaActionDue": "2024-01-11", "cisaExploitAdd": "2023-12-21", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fxc:ae1021_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4F8B5B94-BFD2-4037-B8E2-DCD4F843AD55", "versionEndExcluding": "2.0.10"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:fxc:ae1021:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "03B391D9-2AF4-4889-BFA3-52C11B4390C5"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fxc:ae1021pe_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A110A774-F48F-4F4F-8EE0-FD17F94B8AB6", "versionEndExcluding": "2.0.10"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:fxc:ae1021pe:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "BB758E1E-0CF5-4CA6-9A08-2B33BF296D67"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "vultures@jpcert.or.jp", "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "cisaVulnerabilityName": "FXC AE1021, AE1021PE OS Command Injection Vulnerability"}