« Volver al listado

CVE-2023-28461

Estado: AnalizadaCrítica (9.8)⚠ Explotación activa

Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated "a new Array AG release with the fix will be available soon."

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CISA KEV — explotada activamente

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Gateway SSL-VPN expuesto en red sin autenticación (AV:N/PR:N) permite ejecución remota de código y acceso a credenciales/sesiones según CWE-287; uso en ransomware conocido.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementApplication Developer GuidanceActive Directory ConfigurationVulnerability ScanningUser TrainingUser Account Management

Tecnologías afectadas (1)

Arraynetworks — Arrayos AG

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-28461",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-28461",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-25T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:o:arraynetworks:arrayos_ag:-:*:*:*:*:*:*:*"
          ],
          "vendor": "arraynetworks",
          "product": "arrayos_ag",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "9.4.0.481"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2023-03-15T23:15:10.070",
  "references": [
    {
      "url": "https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_for_Remote_Code_Execution_Vulnerability_AG.pdf",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_for_Remote_Code_Execution_Vulnerability_AG.pdf",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28461",
      "tags": [
        "US Government Resource"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated \"a new Array AG release with the fix will be available soon.\""
    }
  ],
  "lastModified": "2026-08-05T05:16:37.477",
  "cisaActionDue": "2024-12-16",
  "cisaExploitAdd": "2024-11-25",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:arraynetworks:arrayos_ag:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D704D079-D1AF-40EA-98E7-BE1E01371B11",
              "versionEndIncluding": "9.4.0.481"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:arraynetworks:ag1000:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "EBE11A77-8C2F-46CA-87BA-47624380FFC1"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:ag1000t:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "5ED51E1F-3155-40C6-B61C-73D6A9F64987"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:ag1000v5:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F0BC33CF-FA0B-4556-B11E-61FF9B14880A"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:ag1100v5:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A9C8C9AE-AF59-4E5A-93CD-A394F1A31FA0"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:ag1150:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "5E025A9D-6B7C-42B6-95EA-0A5726A919F4"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:ag1200:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "0771D54C-15DF-403C-8CFA-B1E7D0136F50"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:ag1200v5:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "7C9F6B87-E3D2-419A-B086-B981EF912F80"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:ag1500:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "D385DBD0-C4A9-4168-82C2-832E0E40F42D"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:ag1500fips:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "01569AB3-736D-47FE-86DD-F08ACDDCD11E"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:ag1500v5:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "22E45185-071F-414A-AF78-4739F15A1D93"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:ag1600:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "C6F0988E-5E75-486A-9229-956D38A51C35"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:ag1600v5:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "1D09E2CC-C1B5-40DC-AD1A-7C6AB20525DC"
            },
            {
              "criteria": "cpe:2.3:h:arraynetworks:vxag:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "6E149796-E3D7-4FAF-AB64-8D273E701861"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
  "cisaVulnerabilityName": "Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability"
}