CVE-2023-49897

An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

CVSS v3.0 8.8 HIGH

8.8^/10

CVSS v3.0 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.fxc.jp/news/20231206	Release Notes Vendor Advisory
https://jvn.jp/en/vu/JVNVU92152057/	Patch Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-23-355-01
https://www.akamai.com/blog/security-research/zero-day-vulnerability-spreading-mirai-patched

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:fxc:ae1021_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:fxc:ae1021:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:fxc:ae1021pe_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:fxc:ae1021pe:-:*:*:*:*:*:*:*

Information

Published : 2023-12-06 07:15

Updated : 2023-12-22 04:15

NVD link : CVE-2023-49897

Mitre link : CVE-2023-49897

JSON object : View

Products Affected

fxc

ae1021
ae1021pe
ae1021pe_firmware
ae1021_firmware

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://www.fxc.jp/news/20231206", "name": "https://www.fxc.jp/news/20231206", "tags": ["Release Notes", "Vendor Advisory"], "refsource": ""}, {"url": "https://jvn.jp/en/vu/JVNVU92152057/", "name": "https://jvn.jp/en/vu/JVNVU92152057/", "tags": ["Patch", "Third Party Advisory"], "refsource": ""}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-355-01", "name": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-355-01", "tags": [], "refsource": ""}, {"url": "https://www.akamai.com/blog/security-research/zero-day-vulnerability-spreading-mirai-patched", "name": "https://www.akamai.com/blog/security-research/zero-day-vulnerability-spreading-mirai-patched", "tags": [], "refsource": ""}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-78"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2023-49897", "ASSIGNER": "vultures@jpcert.or.jp"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}}, "publishedDate": "2023-12-06T07:15Z", "configurations": {"nodes": [{"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:fxc:ae1021_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2.0.10"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:fxc:ae1021:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}, {"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:fxc:ae1021pe_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2.0.10"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:fxc:ae1021pe:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2023-12-22T04:15Z"}