Critical Missing Authentication in Array Networks AG/vxAG ArrayOS Enables File Read & Code Execution
What It Is
Array Networks’ AG and vxAG appliances running ArrayOS contain a missing authentication check on a core function of the SSL VPN gateway. The flaw permits unauthenticated actors to read arbitrary files on the device and execute code with system privileges.
Exploitability
The vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and carries a CVSS v3.1 base score of 9.8 (Critical). No public exploit code has been released, but inclusion in KEV signals either confirmed exploitation in the wild or a high probability that threat actors are actively targeting it.
Affected Products
- Array Networks AG series SSL VPN gateways
- Array Networks vxAG series SSL VPN gateways running ArrayOS (any version prior to the vendor‑issued patch)
Why It Matters for Compliance & Audit Readiness
Missing authentication directly violates access‑control assurances required by NIST 800‑53 AC‑2, ISO 27001 A.9.2, and related regulatory frameworks. For auditors, the gap highlights a lapse in vendor‑management controls and continuous monitoring. Demonstrating due diligence now means:
- Mapping the flaw to the “Authentication” control in your security framework.
- Capturing immutable evidence of firmware version, patch status, and change‑management tickets.
- Maintaining a defensible audit trail that shows the organization promptly remediated a critical third‑party risk.
Recommended Actions
- Align the vulnerability with the “Access Control – Authentication” control in your risk register.
- Inventory all Array Networks AG/vxAG devices and verify their firmware against the vendor’s advisory.
- Deploy the latest security patch or upgrade to a non‑vulnerable ArrayOS release without delay.
- Record patch deployment evidence (configuration snapshots, ticket logs) for audit purposes.
- Integrate automated scanning of SSL VPN gateways into your continuous monitoring program to flag future authentication gaps.
Source: https://nvd.nist.gov/vuln/detail/CVE-2023-28461