FXC AE1021, AE1021PE OS Command Injection Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-12-21
• EPSS: 50% chance of exploitation in the next 30 days (higher than 99% of CVEs)

[ Description ]Official description

An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

CISA: FXC AE1021 and AE1021PE contain an OS command injection vulnerability that allows authenticated users to execute commands via a network.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 11 Jan 2024): Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• jvn.jp/en/vu/JVNVU92152057Third Party Advisory
• www.akamai.com/blog/security-research/zero-day-vulnerability-spreading-mirai-patchedExploitThird Party Advisory
• www.cisa.gov/news-events/ics-advisories/icsa-23-355-01Third Party AdvisoryUS Government Resource
• www.fxc.jp/news/20231206Release NotesVendor Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource