Array Networks AG Gateway: A Comedy of Errors in Cybersecurity!
JPCERT/CC has reported widespread exploitation of a command injection flaw in Array Networks AG gateways, impacting DesktopDirect users since August 2025. Despite a patch in May, the flaw has been actively exploited, prompting organizations to review their systems and apply security measures to prevent unauthorized access and remote command execution.
Hot Take:
Array Networks’ AG Gateways have officially become the new hot spot in town for cyber attackers. With their command injection flaw, they’re practically hosting a hacker’s spring break! Who needs a CVE number when you’ve got a VIP pass to chaos? Array Networks, consider this your wake-up call to keep the gates guarded and the keys under tighter lock and key!
Key Points:
– Array Networks AG Series gateways have a command injection flaw exploited since August 2025.
– The vulnerability allows attackers to execute arbitrary commands.
– Affected versions are ArrayOS AG 9.4.5.8 and earlier, patched in May 2025.
– Exploitation involves webshell installation, new user creation, and internal intrusions.
– Organizations are advised to apply patches and follow temporary workarounds if needed.