OS Command Injection in FXC AE1021 and AE1021PE Gateways

Historical catalog analysis: CISA added this entry on December 21, 2023. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

In December 2023, it was reported that certain FXC industrial communication gateways contain an OS command injection vulnerability (CVE-2023-49897). This flaw allows a user who has already been authenticated to the device to execute arbitrary operating system commands over the network.

Exposure and applicability

This vulnerability specifically affects the following FXC hardware models:
* AE1021
* AE1021PE

Because these devices typically function as gateways or communication interfaces within operational technology (OT) environments, they often sit at the intersection of different network zones. The risk is applicable to asset owners who utilize these specific models and have not yet applied vendor-provided mitigations. It is important to note that exploitation requires authentication; therefore, the vulnerability is primarily a risk if administrative credentials have been compromised or are shared among unauthorized personnel.

Remediation priorities

Based on the reported vulnerability, our analysis suggests the following priority actions for OT security leaders and controls engineers:

1. Inventory Verification: Identify all instances of AE1021 and AE1021PE devices within the industrial network to determine the scope of exposure.
2. Vendor Mitigation Application: Apply the mitigations provided by FXC according to their official instructions.
3. Lifecycle Evaluation: In cases where vendor mitigations are unavailable or cannot be applied due to operational constraints, evaluate the necessity of the device and consider discontinuing its use in favor of a secure alternative.
4. Access Control Review: Since this is an authenticated vulnerability, review and restrict network access to the management interfaces of these gateways to ensure only authorized engineering workstations can reach them.

How to validate remediation

To verify that exposure has been reduced, operators should:
* Confirm through device logs or version checks that vendor-recommended mitigations have been successfully applied.
* Verify via network configuration audits that the management interfaces of these devices are isolated from general-purpose networks and restricted to a secure management VLAN.

Note: We do not recommend performing active vulnerability scanning or attempting command injection tests on production control equipment, as this may impact device stability and process availability.

Limits and open questions

It remains unknown whether this vulnerability has been leveraged by ransomware campaigns. Additionally, the source does not specify the exact version numbers affected or provide a detailed technical breakdown of the specific input vector used for the command injection. Users should rely on direct vendor guidance to determine if their specific firmware version is vulnerable.

Source and editorial note

CVE-2023-49897: FXC AE1021, AE1021PE OS Command Injection Vulnerability · Source date: December 21, 2023 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: December 24, 2023. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 02, 2026 at 01:20 UTC.

Request an OT security assessment