VULNERABILITY INTELLIGENCE

CVE-2023-28461

CVSS score9.8 CRITICAL

EPSS probability68.08%

CISA KEVKnown exploited vulnerability

Published2023-03-15

Last modified2026-08-05

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability

Vendor / product: Array Networks / AG/vxAG ArrayOS

Description

Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated "a new Array AG release with the fix will be available soon."

Weakness classification

nvd@nist.gov: CWE-287
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-306

Primary references

cve@mitre.org — Mitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mitigation, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource