CVE-2023-49897: FXC AE1021/AE1021PE router firmware OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw allows authenticated remote command execution, is listed in CISA KEV with confirmed in-the-wild exploitation, and carries a high EPSS score, though it requires valid credentials.

What it is

AE1021PE and AE1021 firmware version 2.0.9 and earlier contain an OS command injection flaw (CWE-78). An attacker who can log in to the device can execute arbitrary OS commands, and the vulnerability was exploited in the wild to spread Mirai malware.

Impact

An authenticated attacker gains arbitrary command execution on the device, allowing full compromise of the router and use of it as a foothold for further network activity or botnet recruitment.

Attack surface

Reachable over the network (AV:N) with low attack complexity and no user interaction, but it requires valid credentials (PR:L) to log in to the product before the injection can be triggered.

Exploitation

Listed in CISA KEV (added 2023-12-21) and referenced by an Akamai research blog tagged as an exploit, indicating active exploitation; EPSS 30-day probability is 0.50447 (98.9th percentile). No ransomware campaign use is documented.

What to do

• Apply the vendor firmware update referenced in the FXC advisory (fxc.jp/news/20231206) or discontinue use of affected devices if no fix is available.
• Change default and weak administrative credentials and restrict device management interfaces to trusted networks.
• Place affected devices behind a firewall and block external access to their management ports.
• Monitor for and isolate devices showing signs of Mirai-like botnet behavior.
• Review CISA ICS advisory ICSA-23-355-01 for additional vendor guidance.

Detection

• Inspect device and network logs for unexpected or malformed HTTP requests to the router management interface.
• Monitor for outbound connections from these devices to known Mirai command-and-control infrastructure.
• Audit authentication logs for logins from unusual source addresses or at unusual times preceding command execution.
• Watch for anomalous processes or command execution on the device where host-level visibility exists.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.