FXC Wireless LAN Routers Vulnerable to Zero-Day

Summary

An OS command injection vulnerability exists in AE1021PE/AE1021 routers in firmware version 2.0.9 and earlier. The vulnerability is classified as CVE-2023-49897 and has a CVSS score of 8.8 HIGH. If exploited, the vulnerability allows an arbitrary OS command to be executed by an attacker who can login to the product. This vulnerability is currently under active exploitation by the “InfectedSlurs” botnet and has been designated a zero-day vulnerability.

Impact Assessment

This vulnerability impacts two router models: AE1021PE and AE1021 versions 2.0.9 and earlier. A patch to remediate the vulnerability through a firmware update is available from the vendor. The vendor also provides a recommendation to help prevent exploitation.

Exploitation of the vulnerability allows for OS command injection but is only possible if the attacker can log into the product.

What it means for you

Review your organization’s hardware inventory for any AE1021PE or AE1021 router models. If you have these router models and have a vulnerable version installed, update.

Remediation

1. Update the router firmware to 2.0.10.
2. Reset “Factory setting” and change the default management screen login password.

Business Implications

If your organization’s network is compromised, immediate disaster recovery procedures need to be implemented. Costs, reputational damage, and data disruption/loss could be severe depending on the response, the attacker’s goal, and their know-how.

Access Point Technology Recommends

1. Apply patches: Apply the firmware updates from the vendor.
2. Change default password: The only way an attacker can exploit this vulnerability is if they can log into the device. Changing the default password on the router will prevent an attacker from easily accessing the router. CISA has recently sent out an alert to eliminate default passwords as well which stresses the importance of changing default passwords on ALL devices not just on this particular device.

Associated Bulletins

https://jvn.jp/en/vu/JVNVU92152057/

https://cwe.mitre.org/data/definitions/78.html

https://www.cisa.gov/sites/default/files/2023-12/SbD-Alert-How-Software-Manufacturers-Can-Protect-Customers-by-Eliminating-Default-Passwords-508c_0.pdf