EUVD-2025-201500
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.
Analysis
Array Networks ArrayOS AG before 9.4.5.9 contains an OS command injection vulnerability (CVE-2025-66644, CVSS 7.2) that has been actively exploited in the wild from August through December 2025. KEV-listed, this vulnerability in the VPN/SSL-VPN appliance enables authenticated attackers to execute arbitrary commands on the network edge device.
Technical Context
Array Networks AG is an SSL VPN appliance deployed at network perimeters. The command injection vulnerability allows authenticated users to inject OS commands through the appliance's management or VPN interface. The extended exploitation period (August-December 2025) suggests this was used as a zero-day by advanced threat actors, likely for initial access into corporate networks through the VPN edge device.
Affected Products
['Array Networks ArrayOS AG before 9.4.5.9']
Remediation
Upgrade ArrayOS AG to 9.4.5.9+ immediately. Assume compromise if running vulnerable version during Aug-Dec 2025. Conduct incident response investigation. Reset all VPN user credentials. Review internal network for lateral movement indicators. Check for persistent backdoors on the appliance.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today