{"id":"CVE-2023-28461","kind":"vulnerability","aliases":["CVE-2023-28461"],"related":[],"title":"arraynetworks arrayos ag: Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution","description":"Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated \"a new Array AG release with the fix will be available soon.\"","summary":"Array Networks AG and vxAG ArrayOS SSL VPN appliances have a missing authentication check on a critical function. An unauthenticated attacker can read local files and execute code on the gateway.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2024-11-25T00:00:00+00:00","products":[{"name":"Array Networks AG/vxAG ArrayOS","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"arraynetworks arrayos ag","fixed":[],"affected":"<= 9.4.0.481","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["array-networks","arrayos","exploited","infrastructure","ransomware","ssl-vpn","vxag"],"not_affected_if":["not-array-networks"],"how_to_check":null,"fix":"Apply the vendor mitigations per CISA guidance, or discontinue use of the product if mitigations are unavailable.","status":"open","published_at":"2023-03-15T23:15:10+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:56:09+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T20:56:09Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigations per CISA guidance, or discontinue use of the product if mitigations are unavailable.","reach":"internet","impact":"high","summary":"Array Networks AG and vxAG ArrayOS SSL VPN appliances have a missing authentication check on a critical function. An unauthenticated attacker can read local files and execute code on the gateway.","category":"infrastructure","who_cares":["array-networks","ssl-vpn","vxag","arrayos"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker executes code and reads files on the VPN gateway","analyst_note":"Affected versions, fixed versions and vendor advisory URL are not in the sources; check the Array Networks security advisory and CISA KEV entry for mitigation details and a detection method.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-array-networks"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000466,"input_tokens":2861,"output_tokens":360,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-03':120C '-09':121C '-2023':19A,22A '-28461':20A,23A '2023':119C '9.4.0.481':11A,80C 'advisori':123C 'ag':3A,7A,30A,44B,76C,128C 'ag/vxag':26A 'allow':14A,83C 'applianc':50B 'array':4A,6A,24A,32B,42B,73C,75C,127C 'array-network':31B 'arraynetwork':1A 'arraynetworks':28A 'arrayo':2A,34B,47B 'arrayos':27A,29A 'attack':62B,88C 'attribut':101C 'authent':54B,107C 'avail':135C 'brows':90C 'check':55B 'code':16A,69B,85C 'could':110C 'critic':58B 'cve':18A,21A 'earlier':13A,82C 'execut':17A,68B,86C 'exploit':35B,113C 'file':66B 'filesystem':92C 'fix':132C 'flag':100C 'function':59B 'gateway':72B,97C 'header':105C 'http':104C 'infrastructur':36B 'local':65B 'miss':53B 'network':5A,33B,43B,74C 'networks':25A 'new':126C 'product':109C 'ransomwar':37B 'read':64B 'releas':129C 'remot':15A,84C 'seri':8A,77C 'soon':136C 'ssl':39B,48B,95C 'ssl-vpn':38B 'state':124C 'unauthent':61B 'url':117C 'use':98C 'vendor':122C 'vpn':40B,49B,96C 'vulner':116C 'vxag':10A,41B,46B,79C 'without':106C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-03-15T23:15:10+00:00","kev":{"dateAdded":"2024-11-25","dueDate":"2024-12-16","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-28461","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28461","severity":null,"published_at":"2024-11-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:15+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-28461","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28461","severity":null,"published_at":"2023-03-15T23:15:10+00:00","modified_at":"2026-08-05T05:16:37+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}