CVE-2025-66644
📋 TL;DR
This CVE describes a command injection vulnerability in Array Networks ArrayOS AG VPN appliances. Attackers can execute arbitrary commands on affected systems, potentially gaining full control. Organizations using vulnerable ArrayOS AG VPN appliances are affected.
💻 Affected Systems
- Array Networks ArrayOS AG
📦 What is this software?
Arrayos Ag by Arraynetworks
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to install webshells, steal credentials, pivot to internal networks, and deploy ransomware or other malware.
Likely Case
Attackers install webshells for persistent access, deploy cryptocurrency miners, or use compromised systems as part of botnets.
If Mitigated
Limited impact with proper network segmentation and monitoring, though initial compromise of VPN appliance still occurs.
🎯 Exploit Status
Actively exploited in the wild since August 2025. Exploitation requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.4.5.9
Vendor Advisory: https://x.com/ArraySupport/status/1921373397533032590
Restart Required: Yes
Instructions:
1. Download ArrayOS AG version 9.4.5.9 from Array Networks support portal. 2. Backup current configuration. 3. Apply the update through the web interface or CLI. 4. Reboot the appliance. 5. Verify the update was successful.
🔧 Temporary Workarounds
Network Access Control
allRestrict access to VPN management interface to trusted IP addresses only
Disable Unused Features
allDisable any unnecessary VPN features or management interfaces
🧯 If You Can't Patch
- Isolate the VPN appliance in a DMZ with strict firewall rules
- Implement network segmentation to limit lateral movement from compromised VPN
🔍 How to Verify
Check if Vulnerable:
Check ArrayOS version via web interface (System > About) or CLI command 'show version'Check Version:
show versionVerify Fix Applied:
Verify version is 9.4.5.9 or later and monitor logs for suspicious activity📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in system logs
- Webshell file creation in web directories
- Suspicious process execution
Network Indicators:
- Unusual outbound connections from VPN appliance
- Traffic to known malicious IPs
- Anomalous VPN authentication patterns
SIEM Query:
source="arrayos" AND (event_type="command_execution" OR file_creation=".php" OR file_creation=".jsp")