CVE-2023-28461
Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability
Description
CVE-2023-28461 is a critical remote code execution vulnerability in Array Networks Array AG Series and vxAG SSL VPN gateway appliances running ArrayOS version 9.4.0.481 and earlier. The flaw allows an unauthenticated remote attacker to browse the filesystem on the SSL VPN gateway using a specially crafted flags attribute in an HTTP header, and subsequently exploit a vulnerable URL to achieve remote code execution. With a CVSS v3.1 base score of 9.8 and a network-accessible attack vector requiring no privileges or user interaction, this vulnerability provides complete control over the SSL VPN gateway. CISA has added CVE-2023-28461 to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 16, 2024, and its EPSS score of 87.18% at the 99.4th percentile confirms that this is among the most actively exploited vulnerabilities. This vulnerability is associated with known ransomware campaigns.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| arraynetworks | arrayos ag | <= 9.4.0.481 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_for_Remote_Code_Execution_Vulnerability_AG.pdf(Mitigation, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28461(US Government Resource)
Weakness Type
CWE-287: Improper Authentication
CVE-2023-28461 involves CWE-287 (Improper Authentication), a critical weakness where an application fails to properly verify the identity of users before granting access to protected resources or functionality. In the Array Networks SSL VPN gateway, the authentication mechanism can be bypassed by manipulating HTTP header flags, allowing unauthenticated attackers to access the filesystem and exploit additional attack surfaces that should only be available to authenticated administrators.
CWE-22: Path Traversal
The vulnerability also involves CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), as the authentication bypass enables filesystem browsing through crafted requests. The attacker can navigate the appliance's filesystem to discover and access sensitive files, configuration data, and vulnerable endpoints that facilitate remote code execution.
Impact Analysis
The impact of CVE-2023-28461 is catastrophic across all CIA dimensions. Confidentiality is fully compromised because the filesystem browsing capability exposes all data stored on the SSL VPN appliance, including VPN user credentials, SSL certificates, session tokens, configuration files, and internal network topology information. SSL VPN gateways are by definition positioned at the network perimeter and contain credentials for accessing the internal network, making them extraordinarily high-value targets.
Integrity faces maximum impact as remote code execution grants the attacker complete control over the VPN appliance. Attackers can modify VPN configurations, inject backdoors into the gateway firmware, intercept or alter VPN traffic passing through the appliance, and create persistent access mechanisms that survive reboots and updates.
Availability is fully threatened because the attacker can disable the VPN service, disrupt connectivity for all remote users, or use the compromised gateway as a launching point for attacks against the internal network. The attack requires no authentication (PR:N), no user interaction (UI:N), and has low complexity (AC:L). The EPSS score of 87.18% at the 99.4th percentile and confirmed association with known ransomware campaigns make this one of the most dangerous VPN appliance vulnerabilities. SSL VPN gateways are routinely targeted by ransomware operators who use compromised VPN access as their primary method of initial network entry.
Exploit Maturity
CVE-2023-28461 has reached very high exploit maturity. CISA has confirmed active exploitation and explicitly associated it with known ransomware campaigns, indicating that ransomware operators are actively targeting Array Networks VPN appliances to gain initial network access. The EPSS score of 87.18% at the 99.4th percentile places this among the most exploited vulnerabilities in the current threat landscape.
The Array Networks security advisory provides the vendor's mitigation guidance. SSL VPN appliances have been a primary target for sophisticated threat actors and ransomware groups, with CVE-2023-28461 following a pattern of VPN vulnerability exploitation seen with Pulse Secure, Fortinet, Citrix, and other VPN vendors. Attackers use internet-wide scanning to identify vulnerable Array Networks instances and deploy automated exploitation tools. The strategic value of VPN gateway access — providing authenticated, encrypted entry into corporate networks — makes these vulnerabilities exceptionally attractive for both state-sponsored actors and financially motivated cybercriminals.
Remediation
-
Update ArrayOS immediately to a version beyond 9.4.0.481. Contact Array Networks support or consult the security advisory for the specific patched firmware version and upgrade procedures for your AG Series or vxAG deployment.
-
Implement the vendor-provided mitigation if immediate patching is not possible. The Array Networks advisory includes interim mitigation steps that can reduce the attack surface while the full update is being scheduled and tested.
-
Conduct a thorough forensic investigation on all Array Networks VPN appliances that were running ArrayOS 9.4.0.481 or earlier while exposed to the internet. Review access logs for unusual HTTP requests with manipulated header flags, check for unauthorized filesystem access, look for signs of backdoor installation, and examine VPN connection logs for unauthorized sessions.
-
Rotate all credentials associated with the VPN infrastructure. This includes VPN user accounts, administrator credentials, RADIUS shared secrets, LDAP bind credentials, SSL/TLS certificates and private keys, and any pre-shared keys used for site-to-site VPN tunnels. If the appliance was compromised, assume all credentials stored on or passing through it have been exposed.
-
Deploy enhanced monitoring on the network segments accessible through the VPN. Watch for indicators of lateral movement, unusual authentication patterns, access to sensitive internal resources from VPN users at unusual times, and data exfiltration patterns that may indicate an attacker is already inside the network using stolen VPN credentials.
Technical Details
CVE-2023-28461 is a remote code execution vulnerability in Array Networks Array AG Series and vxAG SSL VPN gateway appliances. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting a network-accessible attack with no prerequisites and maximum impact across all CIA dimensions.
The vulnerability exists in the HTTP request handling logic of the ArrayOS web interface on the SSL VPN gateway. An attacker can manipulate the flags attribute within an HTTP header to bypass the authentication mechanism that normally protects administrative and privileged endpoints. This authentication bypass enables the attacker to browse the appliance's filesystem through crafted HTTP requests, accessing files and directories that should only be available to authenticated administrators.
Once the attacker has filesystem access, they can identify and exploit a vulnerable URL endpoint that enables remote code execution. The exact exploitation mechanism involves leveraging the unauthenticated filesystem access to interact with server-side components in ways that trigger command execution on the underlying operating system with the privileges of the VPN appliance process.
The scope is unchanged (S:U) as the vulnerability operates within the ArrayOS security context, but compromising an SSL VPN gateway has outsized impact because these devices serve as the trusted entry point to corporate networks. The attacker gains the ability to intercept VPN traffic, create unauthorized VPN sessions, pivot into the internal network, and potentially compromise Active Directory environments through harvested credentials.
Affected versions include ArrayOS 9.4.0.481 and all earlier versions across both the Array AG hardware series and the vxAG virtual appliance.
Frequently Asked Questions
What is CVE-2023-28461?
CVE-2023-28461 is a critical remote code execution vulnerability in Array Networks AG Series and vxAG SSL VPN gateways running ArrayOS 9.4.0.481 or earlier. It allows unauthenticated attackers to bypass authentication, browse the filesystem, and execute arbitrary code on the VPN appliance.
Is CVE-2023-28461 being used in ransomware attacks?
Yes. CISA has confirmed that CVE-2023-28461 is associated with known ransomware campaigns. Ransomware operators exploit vulnerable VPN gateways to gain initial access to corporate networks before deploying encryption payloads.
How can I check if my Array Networks appliance is vulnerable?
Check the ArrayOS version running on your AG or vxAG appliance. If it is version 9.4.0.481 or earlier, the device is vulnerable. Contact Array Networks support for the specific patched version and upgrade path.
Why are SSL VPN appliances frequently targeted by attackers?
SSL VPN gateways provide authenticated, encrypted access to internal corporate networks. Compromising a VPN appliance gives attackers the same level of network access as a legitimate remote employee, making it an ideal entry point that often bypasses many layers of perimeter security.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.