CVE-2023-28461 Known ransomware use

Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability

Array Networks — AG/vxAG ArrayOS

Added to KEV catalog: 25 November 2024
Federal remediation due date: 16 December 2024
Weakness classification (CWE): CWE-306

CISA Description

Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_for_Remote_Code_Execution_Vulnerability_AG.pdf ; https://nvd.nist.gov/vuln/detail/CVE-2023-28461

View on NVD View on MITRE CVE View full CISA catalog

More Array Networks Vulnerabilities

CVE-2025-66644

Array Networks ArrayOS AG OS Command Injection Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services