CVE-2023-28461

The vulnerability present in the Array Networks Array AG Series and vxAG versions prior to 9.4.0.481 is characterized by a critical flaw that allows for remote code execution. This issue arises from improper handling of HTTP headers, specifically through the exploitation of a flags attribute that enables an attacker to traverse the filesystem of the SSL VPN gateway without requiring any form of authentication. By manipulating the HTTP request, an attacker can gain unauthorized access to sensitive files and potentially execute arbitrary code on the affected system, leading to severe security breaches.

Exploitation of this vulnerability can occur through various attack vectors. An attacker could initiate a targeted HTTP request to the SSL VPN gateway, leveraging the flags attribute to navigate the filesystem. Once access is gained, the attacker can locate vulnerable URLs that may allow for further exploitation, such as uploading malicious scripts or executing commands on the server. This scenario is particularly concerning as it does not necessitate any form of user authentication, making it accessible to unauthenticated attackers who can exploit the vulnerability from anywhere on the internet. The ease of exploitation, combined with the potential for significant damage, underscores the urgency for organizations to address this vulnerability promptly.

The real-world impact of this vulnerability is profound, posing substantial business risks. Organizations utilizing the affected products may face data breaches, loss of sensitive information, and potential legal ramifications due to non-compliance with data protection regulations. The ability for an attacker to execute arbitrary code can lead to a complete compromise of the affected system, allowing for further lateral movement within the network. This could result in the theft of intellectual property, customer data, or even the disruption of critical business operations. The financial implications of such incidents can be devastating, including costs associated with incident response, system recovery, and reputational damage.

To detect and mitigate the risks associated with this vulnerability, organizations should adopt a multi-faceted approach. Regularly updating and patching systems is paramount, as the vendor has indicated that a new release containing a fix will be available soon. Organizations should prioritize the deployment of this update as part of their patch management strategy. Additionally, implementing robust network security measures, such as intrusion detection systems (IDS) and web application firewalls (WAF), can help identify and block malicious traffic attempting to exploit this vulnerability. Monitoring logs for unusual access patterns or unauthorized file access can also aid in early detection of potential exploitation attempts.

In conclusion, the vulnerability affecting the Array Networks Array AG Series and vxAG represents a significant threat to organizations utilizing these products. The potential for remote code execution without authentication poses a serious risk to data integrity and system security. By understanding the technical details of the vulnerability, recognizing possible exploitation scenarios, and implementing effective detection and mitigation strategies, organizations can better protect themselves against the ramifications of this critical security issue. It is essential for businesses to remain vigilant and proactive in their cybersecurity efforts to safeguard their assets and maintain trust with their stakeholders.

CSURFACE threat intelligence has detected a slight increase in activity related to CVE-2023-28461, indicating a modest uptick in attempts to exploit the remote code execution vulnerability in Array Networks AG/vxAG devices. While the overall frequency remains low, this upward trend signals growing interest from threat actors, including those linked to ransomware operations known to leverage this vulnerability. The EPSS score remains high and stable, underscoring the continued potential for impactful exploitation. This development elevates the urgency for defenders to maintain heightened monitoring and situational awareness, as the vulnerability’s exploitation could facilitate unauthorized system access and data compromise. Although no new exploit variants or proof-of-concept releases have surfaced, the observed increase in detection activity suggests adversaries are actively probing affected environments, reinforcing the criticality of this threat in the current landscape.

Update 2 — August 04, 2026

CSURFACE threat intelligence has detected a subtle yet consistent increase in activity related to CVE-2023-28461, reflected in a modest rise in telemetry signals and a slight uptick in the EPSS score. This trend indicates that threat actors continue to actively probe and potentially exploit vulnerable Array Networks AG/vxAG devices, maintaining the vulnerability’s relevance in the threat landscape. The inclusion of this CVE in the KEV catalog, with explicit links to ransomware use, underscores its attractiveness to financially motivated adversaries seeking initial access or lateral movement opportunities. Although no new exploit variants or proof-of-concept codes have been identified, the persistent probing activity suggests adversaries are refining their tactics or expanding targeting efforts. For defenders, this evolving pattern signals a sustained and possibly growing risk of unauthorized remote code execution, reinforcing the need for vigilant monitoring of affected systems. The threat level remains critical, with the incremental increase in exploitation indicators emphasizing that the vulnerability continues to pose a high-impact risk in operational environments.

Update 3 — August 19, 2026

CSURFACE threat intelligence has identified a slight increase in exploitation attempts targeting CVE-2023-28461, reflecting a continued interest by threat actors in leveraging this critical remote code execution vulnerability. While no new exploit variants or proof-of-concept codes have surfaced, the incremental rise in detection activity suggests adversaries may be intensifying reconnaissance or broadening their attack scope. This subtle uptick aligns with the vulnerability’s inclusion in the KEV catalog and its known association with ransomware campaigns, underscoring its attractiveness for financially motivated threat groups. The stable EPSS score near the top percentile reinforces the high likelihood of exploitation in the wild. For defenders, this evolving pattern signals that the vulnerability remains an active and persistent threat, warranting sustained vigilance despite the absence of novel exploitation techniques. Consequently, the overall risk posture remains critical, with the recent telemetry trends indicating a steady, if modest, escalation in adversarial engagement.