Critical severity · published Mar 15, 2023
CVE-2023-28461
Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability
RansomwareIn wildKEV
9.8
CVSS
68.1%
EPSS
Yes
On KEV
Description
Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated "a new Array AG release with the fix will be available soon."
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)68.1% · higher than 99% of CVEs
Exploited in the wildYes
CISA KEVListed Nov 25, 2024
Federal remediation dueDec 16, 2024
Ransomware campaign useKnown
Affected products
Which versions
AA
Arrayos AG · Arraynetworks
through 9.4.0.481 · source: NVD, CISA
AA
AG/vxAG ArrayOS · Array Networks
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-28461
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-28461
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
support.arraynetworks.net
https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_for_Remote_Code_Execution_Vulnerability_AG.pdf
More from Arrayos AG
9.8
CVE-2025-66644
Array Networks ArrayOS AG OS Command Injection Vulnerability
9.8
CVE-2023-51707
MotionPro in Array ArrayOS AG before 9.4.0.505 on AG and vxAG allows remote command execution via crafted packets
9.8
CVE-2022-42897
Array Networks AG/vxAG with ArrayOS AG before 9.4.0.469 allows unauthenticated command injection that leads to privilege escalation and control of the system
7.5
CVE-2023-41121
Array AG OS before 9.4.0.499 allows denial of service: remote attackers can cause system service processes to crash through abnormal HTTP operations
4.9
CVE-2023-24613
The user interface of Array Networks AG Series and vxAG through 9.4.0.470 could allow a remote attacker to use the gdb tool to overwrite the backend function call stack after…