CVE-2023-49897: FXC AE1021, AE1021PE OS Command Injection Vulnerability

High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2023-12-21. EPSS: 50.4% chance of exploitation in the next 30 days.

An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

Affected products

• FXC AE1021 Firmware: before 2.0.10 (fixed in 2.0.10)
• FXC AE1021PE Firmware: before 2.0.10 (fixed in 2.0.10)

Published 2023-12-06. Last modified 2026-06-17.