« Volver al listado

CVE-2023-28460

Estado: ModificadaAlta (7.2)—

A command injection vulnerability was discovered in Array Networks APV products. A remote attacker can send a crafted packet after logging into the affected appliance as an administrator, resulting in arbitrary shell code execution. This is fixed in 8.6.1.262 or newer and 10.4.2.93 or newer.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Arraynetworks — Array OS

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-28460",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-28460",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-27T14:18:23.252471Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-03-15T23:15:10.013",
  "references": [
    {
      "url": "https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_Command_Injection_Vulnerabilities_APV_ID-133258.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_Command_Injection_Vulnerabilities_APV_ID-133258.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A command injection vulnerability was discovered in Array Networks APV products. A remote attacker can send a crafted packet after logging into the affected appliance as an administrator, resulting in arbitrary shell code execution. This is fixed in 8.6.1.262 or newer and 10.4.2.93 or newer."
    }
  ],
  "lastModified": "2026-06-17T05:47:47.293",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:arraynetworks:array_os:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B95D68DD-66E0-49E9-A629-CFC27B1B64AE",
              "versionEndIncluding": "8.6.1.243"
            },
            {
              "criteria": "cpe:2.3:o:arraynetworks:array_os:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A495E881-FB00-4D4F-823B-74E09A8FFF13",
              "versionEndIncluding": "10.4.0.79",
              "versionStartIncluding": "9.0.1.12"
            },
            {
              "criteria": "cpe:2.3:o:arraynetworks:array_os:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B21C2B5E-B719-405E-A440-8E696B1CE783",
              "versionEndIncluding": "10.4.2.58",
              "versionStartIncluding": "10.4.2.12"
            },
            {
              "criteria": "cpe:2.3:o:arraynetworks:array_os:10.4.3.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C2866A3C-911B-451E-8D1E-FB2D3FE44BD1"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:arraynetworks:apv10650:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "4B8896E1-0827-4DF6-A632-59E1C070BF04"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:apv11600:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "3B8B1A9F-751E-4DB9-89EB-26EDAD38D277"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:apv1600:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "91D1CE39-AAE9-41E8-9EBE-52CE62F04A12"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:apv1600t:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "1B69124F-8796-41C8-AEDF-A78623777E04"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:apv1600v5:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "5593430D-614C-41B7-BFDE-DC386B071E2D"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:apv1800:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A31B40DD-3C61-45E4-9A32-CAC257E28C4A"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:apv2600:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "9EC12DCC-F257-4FF8-9AC3-F45F1AF1C3E8"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:apv2600v5:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "BEC95ED6-D1DC-4E64-917F-36796B5B2492"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:apv2800:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "2F54F2DE-889D-4036-AB92-74EE347FF689"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:apv3600:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "27F1DC25-40C7-433C-A8A1-5BA0BF7B8203"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:apv3600v5:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "243C97F3-4440-4A7D-BF6A-59CDC5611001"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:apv3650:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "71B5A8EA-7442-4F51-9A2B-1658A9918534"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:apv5600:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "3D0CEF16-7C68-4BA0-BD75-210DD155255F"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:apv5800:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "5E3C0C3B-09EB-411D-90DF-69B0F90024C4"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:apv6600:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "7209BC0E-E55F-4071-923F-25DD4FA3C281"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:apv6600fips:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "D3025939-798D-4B63-A3FE-712E15D6CC3F"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:apv7600:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "0FF0EC72-8236-430B-B759-46ACFEF3E9CD"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:apv7800:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "935D6EB4-2B2C-43E0-8FCF-01B559840DF8"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:apv800:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A1D81145-DB70-4819-BA19-773102337AA8"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:vapv:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "C18E4F55-6CF4-40D8-954E-12640A4D5224"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}