CVE‑2025‑66644: Array Networks ArrayOS AG OS Command Injection Vulnerability
What It Is – Array Networks disclosed that its ArrayOS AG operating system contains an OS command‑injection flaw. An attacker who can supply crafted input may cause the underlying host to execute arbitrary operating‑system commands.
Exploitability – The vulnerability is publicly disclosed with an assigned CVSS 7.5 (High). No public exploits have been observed, but the attack vector is straightforward and could be weaponized by a motivated adversary.
Affected Products – All deployments of Array Networks ArrayOS AG (the OS that powers the vendor’s load‑balancers, WAN‑optimizers, and other network appliances).
Why It Matters for Trust & Control Assurance
- Demonstrates a gap in secure configuration management – a core control objective that spans multiple frameworks (e.g., NIST CSF 2.0, ISO 27001).
- Continuous monitoring of command‑execution logs provides defensible evidence that the control is operating as intended.
- Enterprises increasingly demand proof of due‑diligence — a patched, auditable configuration is a tangible trust signal for buyers and auditors.
Recommended Actions
- Deploy the vendor‑issued patch or apply the mitigation guidance immediately.
- Validate input‑handling routines and enforce strict command‑execution controls on all ArrayOS AG devices.
- Update your control‑mapping repository to include OS‑command validation and ensure log collection for audit trails.
Source: CISA KEV – CVE‑2025‑66644