Hackers exploit critical bug in Array Networks SSL VPN products
America's Cyber Defense Agency has received evidence of hackers actively exploiting a remote code execution vulnerability in SSL VPN products Array Networks AG and vxAG ArrayOS.
The security issue is tracked as CVE-2023-28461 and has been assigned a critical 9.8 severity score and the agency has included it to the catalog of Known Exploited Vulnerabilities (KEV).
The bug can be exploited through a vulnerable URL and is an improper authentication issue that allows remote code execution in Array AG Series and vxAG version 9.4.0.481 and earlier.
"(CVE-2023-28461 is) […] a web security vulnerability that allows an attacker to browse the filesystem or execute remote code on the SSL VPN gateway using flags attribute in HTTP header without authentication," the vendor says in a security bulletin.
The flaw was disclosed last year on March 9 and Array Networks fixed it about a week later with release of Array AG release 9.4.0.484.
Array Networks AG Series (hardware appliances) and vxAG Series (virtual appliances) are SSL VPN products offer secure remote and mobile access to corporate networks, enterprise applications, and cloud services.
According to the vendor, they are used by over 5,000 customers worldwide, including enterprises, service providers, and government agencies.
CISA has not provided any details on who is taking advantage of the vulnerability and targeted organizations but added it to the Known Exploited Vulnerabilities (KEV) catalog "based on evidence of active exploitation."
The agency recommends that all federal agencies and critical infrastructure organizations either apply security updates and available mitigations by December 16 or stop using the product.
Security updates for the impacted products are available through the Array support portal. The vendor also provides in the security advisory a set of commands to mitigate the vulnerability if updates cannot be installed immediately.
However, organizations should first test the effect of the commands as they may have a negative impact on the functionality of Client Security, the VPN client's ability to upgrade automatically, and the Portal User Resource function.
source: BleepingComputer
Free online web security scanner
Top News:
Ivanti Flaw CVE-2025-0282 Actively Exploited, Impacts Connect Secure and Policy Secure
January 9, 2025Thousands of BeyondTrust Systems Remain Exposed
January 4, 2025Windows Server 2025 released—here are the new features
November 5, 2024Cryptocurrency wallet drainers stole $494 million in 2024
January 5, 2025