CVE-2025-66644
Array Networks ArrayOS AG OS Command Injection Vulnerability
Description
CVE-2025-66644 is a high-severity OS command injection vulnerability in Array Networks ArrayOS AG, a widely deployed SSL VPN gateway used by enterprises and government agencies for secure remote access. The vulnerability exists in versions prior to 9.4.5.9 and allows an authenticated attacker with administrative privileges to inject and execute arbitrary operating system commands on the underlying system. With a CVSS v3.1 base score of 7.2, this vulnerability has been actively exploited in the wild from August through December 2025 as confirmed by multiple security advisories. CISA has added CVE-2025-66644 to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 29, 2025, and the EPSS score of 3.06% at the 86.5th percentile reflects significant real-world exploitation activity targeting VPN infrastructure.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| arraynetworks | arrayos ag | < 9.4.5.9 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.bleepingcomputer.com/news/security/hackers-are-exploiting-arrayos-ag-vpn-flaw-to-plant-webshells/(Press/Media Coverage)
- https://www.jpcert.or.jp/at/2025/at250024.html(Third Party Advisory)
- https://x.com/ArraySupport/status/1921373397533032590(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-66644(US Government Resource)
Weakness Type
CWE-78: OS Command Injection
CVE-2025-66644 is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), one of the most critical software weakness categories. This vulnerability class arises when an application passes user-controllable input directly into operating system shell commands without adequately sanitizing or escaping special characters such as semicolons, pipes, backticks, or command substitution sequences. In the ArrayOS AG management interface, certain administrative input fields or API parameters are incorporated into system-level commands. Because the application fails to neutralize shell metacharacters, an attacker with administrative access can append additional commands that execute with the privileges of the underlying operating system process. OS command injection is consistently ranked among the most dangerous weaknesses because it provides a direct path from application-layer input to full system compromise. Learn more about CWE-78
Impact Analysis
The exploitation of CVE-2025-66644 carries severe consequences across all three dimensions of the CIA triad, each rated as high in the CVSS assessment. Confidentiality is fully compromised because successful command injection on a VPN gateway grants attackers access to VPN configuration data, user credentials, session tokens, private keys, and network routing information. Since ArrayOS AG serves as the perimeter security gateway, this data exposure can reveal the entire internal network topology and authentication infrastructure.
Integrity is critically impacted as attackers can modify VPN configurations, inject backdoor accounts, alter access control lists, and tamper with logging mechanisms to conceal their presence. The ability to modify the VPN gateway configuration means attackers can redirect traffic, intercept communications, or create persistent unauthorized access paths into the internal network.
Availability faces high risk since command injection enables attackers to disable VPN services, corrupt the operating system, exhaust system resources, or render the gateway inoperable. For organizations relying on ArrayOS AG as their primary remote access solution, this could sever connectivity for the entire remote workforce. The confirmed active exploitation in the wild from August through December 2025, as reported by JPCERT/CC and BleepingComputer, indicates that threat actors are deploying webshells on compromised devices to maintain persistent access. Although the ransomware association remains unknown, VPN gateway compromises are a well-established initial access vector for ransomware operators.
Exploit Maturity
CVE-2025-66644 has been confirmed as actively exploited in the wild, with exploitation campaigns running from August through December 2025. CISA's inclusion in the Known Exploited Vulnerabilities catalog provides authoritative confirmation of real-world attacks. The EPSS score of 3.06% at the 86.5th percentile places this vulnerability in the top 14% of all vulnerabilities for exploitation probability.
Security researchers and incident responders have documented that attackers are specifically targeting ArrayOS AG VPN gateways to plant webshells, as detailed in BleepingComputer's coverage. Webshell deployment indicates sophisticated threat actors seeking persistent access rather than opportunistic exploitation. JPCERT/CC issued an alert specifically warning about this exploitation campaign, further corroborating the severity and breadth of attacks. Array Networks acknowledged the issue via their official support channel. While the ransomware association is currently classified as unknown by CISA, the pattern of VPN gateway exploitation followed by webshell deployment is a hallmark of advanced persistent threat (APT) groups and ransomware affiliates who use compromised perimeter devices as beachheads for lateral movement into enterprise networks.
Remediation
-
Upgrade ArrayOS AG immediately to version 9.4.5.9 or later. This is the most critical step, as the vendor has released a patch that addresses the command injection vulnerability. Consult the Array Networks support portal and the advisory referenced at CISA KEV for specific upgrade procedures.
-
Conduct a forensic investigation of all ArrayOS AG appliances that were running vulnerable versions during the exploitation window of August through December 2025. Search for indicators of compromise including unauthorized webshells, unexpected files in web-accessible directories, new or modified administrative accounts, and suspicious outbound network connections. BleepingComputer's report documents webshell deployment as the primary post-exploitation technique.
-
Restrict administrative access to the ArrayOS AG management interface. Limit management access to specific trusted IP addresses or management VLANs. Implement multi-factor authentication for all administrative sessions. Audit and reduce the number of accounts with administrative privileges.
-
Rotate all credentials associated with the VPN infrastructure, including administrator passwords, VPN user credentials, SSL certificates, and any API keys or shared secrets configured on the appliance. If the device was compromised, all credentials stored on or passing through it should be considered exposed.
-
Deploy network monitoring to detect anomalous traffic patterns from VPN gateways, including unexpected outbound connections, unusual data transfer volumes, and connections to known malicious infrastructure. Monitor for webshell indicators such as unusual HTTP request patterns to the management interface.
Technical Details
CVE-2025-66644 is an OS command injection vulnerability in Array Networks ArrayOS AG versions prior to 9.4.5.9. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, producing a base score of 7.2.
The vector breakdown reveals important characteristics of the attack surface. Attack Vector (AV:N) confirms the vulnerability is exploitable remotely over the network, which is expected for a VPN gateway management interface. Attack Complexity (AC:L) indicates that exploitation does not require special conditions or preparation beyond having the necessary access. Privileges Required (PR:H) means the attacker must have high-level (administrative) privileges on the ArrayOS AG device, which limits the initial attack surface but does not diminish the impact given that administrative credentials can be obtained through phishing, credential stuffing, or prior compromise. User Interaction (UI:N) confirms no victim participation is needed. Scope (S:U) indicates the impact is contained to the vulnerable component, though in practice a compromised VPN gateway provides a pivot point into the entire internal network.
The attack mechanism involves injecting OS commands through the ArrayOS AG management interface. When an administrator interacts with certain management functions, the application constructs system-level commands that incorporate user-supplied input. Due to insufficient input validation and the absence of proper command parameterization, an attacker can inject shell metacharacters and additional commands that execute on the underlying operating system with the privileges of the VPN gateway process. The confirmed deployment of webshells in exploitation campaigns indicates that attackers are using the command injection to write persistent backdoor scripts to web-accessible directories on the appliance.
Frequently Asked Questions
What is CVE-2025-66644?
CVE-2025-66644 is an OS command injection vulnerability in Array Networks ArrayOS AG SSL VPN gateway versions prior to 9.4.5.9. It allows authenticated administrators to execute arbitrary operating system commands on the underlying system, and it has been actively exploited in the wild to deploy webshells on compromised devices.
Has CVE-2025-66644 been exploited in the wild?
Yes, CVE-2025-66644 has been confirmed as actively exploited from August through December 2025. CISA added it to the Known Exploited Vulnerabilities catalog, and security researchers have documented campaigns where attackers planted webshells on compromised ArrayOS AG devices.
What versions of ArrayOS AG are affected?
All versions of Array Networks ArrayOS AG prior to 9.4.5.9 are vulnerable. Organizations should upgrade to version 9.4.5.9 or later immediately.
Why are VPN gateways high-value targets?
VPN gateways sit at the network perimeter and handle authentication for remote users, making them ideal targets for gaining initial access to internal networks. A compromised VPN gateway can provide attackers with credentials, network visibility, and a persistent foothold from which to conduct lateral movement and data exfiltration.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.