---
id: "CVE-2023-49897"
kind: "vulnerability"
aliases: ["CVE-2023-49897"]
title: "An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware\u2026"
severity: "high"
cvss: 8.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "FXC AE1021, AE1021PE", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "fxc ae1021 firmware", "fixed": ["2.0.10"], "affected": "< 2.0.10", "ecosystem": "vendor"}, {"name": "fxc ae1021pe firmware", "fixed": ["2.0.10"], "affected": "< 2.0.10", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["ae1021", "ae1021pe", "embedded-devices", "exploited", "fxc", "infrastructure"]
not_affected_if: ["no-ae1021-deployed"]
published_at: "2023-12-06T07:15:41+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-49897", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49897", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware…

FXC AE1021 and AE1021PE devices have an OS command injection flaw. An authenticated user can run arbitrary operating system commands on the device over the network.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FXC AE1021, AE1021PE affected ? fixed ?
- vendor:fxc ae1021 firmware affected < 2.0.10 fixed 2.0.10
- vendor:fxc ae1021pe firmware affected < 2.0.10 fixed 2.0.10

## Fix

Apply the mitigations the vendor publishes, or stop using the product if no mitigation exists (per CISA required action).

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-49897
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-49897

## From the sources

FXC AE1021 and AE1021PE contain an OS command injection vulnerability that allows authenticated users to execute commands via a network.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_