CVE-2023-28461

Producto

Array Networks / AG/vxAG ArrayOS

Vulnerabilidad

Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability

Añadido a KEV

25 nov 2024

Remediar antes de

16 dic 2024

Uso conocido en ransomware

Sí

Descripción resumida

Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway.

Acción requerida

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notas

https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_for_Remote_Code_Execution_Vulnerability_AG.pdf ; https://nvd.nist.gov/vuln/detail/CVE-2023-28461