CVE Watch5 de ago. de 2026

CVE-2023-28461

Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability

CVSS

9.8

Crítica

EPSS

68.1%

p99

KEV

SIM

25 de nov. de 2024

Exploit Today

0-100

Publicado: 15 de mar. de 2023 · Última mod.: 5 de ago. de 2026 · CWE-287 · CWE-306

EPSS · 30d

68.1%EPSS · 30 dias68.1%

2026-10-082026-11-05

Ficha do catálogo KEV

Produto

Array Networks / AG/vxAG ArrayOS

Vulnerabilidade

Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability

Adicionado ao KEV

25 de nov. de 2024

Corrigir até

16 de dez. de 2024

Uso conhecido em ransomware

Sim

Descrição resumida

Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway.

Ação necessária

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notas

https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_for_Remote_Code_Execution_Vulnerability_AG.pdf ; https://nvd.nist.gov/vuln/detail/CVE-2023-28461

Descrição técnica

Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated "a new Array AG release with the fix will be available soon."

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-110390—

—

———Missing authentication in the FlexNet Beacon component of Flexera One and FlexNet Manager Suite allows unauthenticated remote attackers to obtain Beacon policy and targeting information when anonymous web server access is enabled (the default).4h CVE-2026-111493—

—

———Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and collect users' photos. Linking these photos to identities may be facilitated by other vulnerabilities in the platform.4h CVE-2026-492728.5 ALT

—

———OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.3.0 until 4.0.1, OAuthLib's RFC 8628 device workflow does not require DeviceCodeGrant.validate_token_request to check that the device_code parameter is present and valid. A caller whose client request is accepted by the configured validator and who knows a valid client ID enabled for the device workflow can submit a missing or bogus device code to the token endpoint and obtain a bearer token without completing device authorization. This issue is fixed in version 4.0.1.5h CVE-2026-1030205.3 MÉD

—

——0OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the webroot admin.php multisite administration page is enabled without an authentication check, reads database configuration from sqlconf.php, and connects to each configured site database. An unauthenticated network actor can obtain site identifiers, database names, site names, exact OpenEMR versions and patch levels, pending upgrade status, and direct login and patient-portal links. This issue is fixed in version 8.3.0.7h CVE-2026-1232088.8 ALT

—

——0noname Electron desktop build v1.11.2 through v1.11.6.1 contains an unauthenticated local file server with wildcard CORS that allows malicious websites to read, overwrite, or delete installation files. Attackers can send cross-origin requests to /writeFile on localhost port 8089 to overwrite renderer scripts, executing JavaScript with Node.js access as the local user.8h CVE-2026-1232063.7 BAI

—

——0EdgeChat before 2.20.3 contains a missing authentication vulnerability in the GET /files/:key route that allows unauthenticated or banned users to download decrypted public-channel attachments because canAccessFile() accepts a null user id. Attackers holding an attachment object key can omit or supply an invalid token to retrieve plaintext attachments without a session or channel membership.8h