Patchfirst
Patchfirst
CVE-2023-28461 KEVRansomware Critical · 9.8 EPSS 68.1%

Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability

Array Networks · AG/vxAG ArrayOS

Summary

Array Networks AG Series and vxAG SSL VPN gateways running ArrayOS 9.4.0.481 and earlier contain a missing-authentication flaw in a critical function. The flaw lies in how the product handles requests, leaving it reachable without any credentials. An attacker with network access to the gateway can, without authentication or user interaction, browse the filesystem by abusing a flags attribute in an HTTP header and then exploit a vulnerable URL to achieve remote code execution.

Official description · NVD

Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated "a new Array AG release with the fix will be available soon."

Breakdown
78.6 / 100
Exploited
Yes, in CISA KEV
Reports
1
Tactics
3/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What they do

First seen exploited 18 months after disclosure.

  1. Disclosedday 0
  2. First seen exploitedVulnCheck KEV evidence+18 mo
  3. Named in a threat reporttrendmicro.com+20 mo
  4. Added to CISA KEVknown ransomware use; EU database agrees+20 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

3 , grouped by in kill-chain order, 3 cited passages 3

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium
AI mapping from the description · how it is exploited

unauthenticated remote attack on public-facing VPN gateway

allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway
From the official description (NVD) Original (opens in a new tab) ↗

ExecutionTA0002

Command and Scripting Interpreter T1059 Medium
AI mapping from the description · primary impact

stated remote code execution impact

allow remote code execution
From the official description (NVD) Original (opens in a new tab) ↗

DiscoveryTA0007

File and Directory Discovery T1083 Medium
AI mapping from the description · primary impact

browsing filesystem enables file discovery

An attacker can browse the filesystem on the SSL VPN gateway
From the official description (NVD) Original (opens in a new tab) ↗

Detection

0 rules for this CVE · 268 general rules for its techniques

Rules for this CVE

0 that reference CVE-2023-28461 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules
All 149 on SigmaHQ ↗
Command and Scripting InterpreterT105995 general rules
All 95 on SigmaHQ ↗
File and Directory DiscoveryT108324 general rules
All 24 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 1 threat report
1 reportTrend MicroNov 2024

Reports are matched by finding the exact id CVE-2023-28461 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

2 links, grouped by NVD tag (1 duplicate merged)

Vendor Advisory 1

support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_for_Remote_Code_Execution_Vulnerability_AG.pdf

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28461
↑ ↓ chooseEnter openEsc close