Actively exploited in the wild
Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability
Array Networks - AG/vxAG ArrayOS · Listed in the CISA KEV since 2024-11-25. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-28461
CriticalCVSS 9.8KEVExploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL.
Risk Assessment
An unauthenticated attacker can access files and execute code on the VPN gateway, potentially leading to confidentiality and integrity breaches.
Recommendation
Update Array AG to a patched version when available and restrict access to the VPN gateway.
Original NVD description (English source)
Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated "a new Array AG release with the fix will be available soon."