Hackers exploit critical bug in Array Networks SSL VPN products

America’s Cyber Defense Agency has received evidence of hackers actively exploiting a remote code execution vulnerability in SSL VPN products Array Networks AG and vxAG ArrayOS.

The security issue is tracked as CVE-2023-28461 and has been assigned a critical 9.8 severity score and the agency has included it to the catalog of Known Exploited Vulnerabilities (KEV).

The bug can be exploited through a vulnerable URL and is an improper authentication issue that allows remote code execution in Array AG Series and vxAG version 9.4.0.481 and earlier.

“(CVE-2023-28461 is) […] a web security vulnerability that allows an attacker to browse the filesystem or execute remote code on the SSL VPN gateway using flags attribute in HTTP header without authentication,” the vendor says in a security bulletin.

The flaw was disclosed last year on March 9 and Array Networks fixed it about a week later with release of Array AG release 9.4.0.484.

Array Networks AG Series (hardware appliances) and vxAG Series (virtual appliances) are SSL VPN products offer secure remote and mobile access to corporate networks, enterprise applications, and cloud services.

According to the vendor, they are used by over 5,000 customers worldwide, including enterprises, service providers, and government agencies.

CISA has not provided any details on who is taking advantage of the vulnerability and targeted organizations but added it to the Known Exploited Vulnerabilities (KEV) catalog “based on evidence of active exploitation.”

The agency recommends that all federal agencies and critical infrastructure organizations either apply security updates and available mitigations by December 16 or stop using the product.

Security updates for the impacted products are available through the Array support portal. The vendor also provides in the security advisory a set of commands to mitigate the vulnerability if updates cannot be installed immediately.

However, organizations should first test the effect of the commands as they may have a negative impact on the functionality of Client Security, the VPN client’s ability to upgrade automatically, and the Portal User Resource function.