CVE-2023-28461 — CRITICAL (9.8)

Q: How severe is CVE-2023-28461?

CVE-2023-28461 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Q: Is there a patch for CVE-2023-28461?

Check the references section above for vendor advisories and patch information. Affected products include: Arraynetworks Arrayos Ag, Arraynetworks Ag1000, Arraynetworks Ag1000T, Arraynetworks Ag1000V5, Arraynetworks Ag1100V5.

Vulnerability Description

Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated "a new Array AG release with the fix will be available soon."

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Arraynetworks	Arrayos Ag	<= 9.4.0.481
Arraynetworks	Ag1000	-
Arraynetworks	Ag1000T	-
Arraynetworks	Ag1000V5	-
Arraynetworks	Ag1100V5	-
Arraynetworks	Ag1150	-
Arraynetworks	Ag1200	-
Arraynetworks	Ag1200V5	-
Arraynetworks	Ag1500	-
Arraynetworks	Ag1500Fips	-
Arraynetworks	Ag1500V5	-
Arraynetworks	Ag1600	-
Arraynetworks	Ag1600V5	-
Arraynetworks	Vxag	-

Related Weaknesses (CWE)

CWE-306 CWE-287

References

https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/dMitigationVendor Advisory
https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/dMitigationVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-US Government Resource

FAQ

What is CVE-2023-28461?

CVE-2023-28461 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header with...

How severe is CVE-2023-28461?

CVE-2023-28461 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2023-28461?

Check the references section above for vendor advisories and patch information. Affected products include: Arraynetworks Arrayos Ag, Arraynetworks Ag1000, Arraynetworks Ag1000T, Arraynetworks Ag1000V5, Arraynetworks Ag1100V5.