JPCERT/CC Reports Widespread Exploitation of Array Networks AG Gateway Vulnerability

JPCERT/CC has warned that Array Networks AG Series gateways have been under active exploitation since August 2025, in response to a command injection flaw that affects DesktopDirect. The flaw allows an attacker to execute arbitrary commands, and exploitation was serious enough to prompt a patch on 11 May 2025 for ArrayOS AG versions 9.4.5.8 and earlier, with version 9.4.5.9 released to address the issue.

The attack pattern includes webshell installation, creation of new user accounts, and internal intrusions, with traffic traced to IP 194.233.100[.]138. The U.S. CISA added CVE-2023-28461 to its Known Exploited Vulnerabilities catalog in November 2024, highlighting the remote code execution risk via an unauthenticated access path to the SSL VPN gateway.

According to JPCERT/CC, organisations using Array Networks AG Series or DesktopDirect should review guidance, investigate for signs of intrusion, apply vendor patches or workarounds, and monitor for indications of compromise to prevent further exploitation.