CVE-2025-66644

HIGHCISA KEV

7.2

Description

Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.

CVE Details

CVSS v3.1 Score7.2

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredHIGH

User InteractionNONE

Published12/5/2025

Last Modified12/10/2025

Sourcekev

Honeypot Sightings0

CISA KEV

VendorArray Networks

ProductArrayOS AG

Vulnerability NameArray Networks ArrayOS AG OS Command Injection Vulnerability

KEV Date Added2025-12-08

Remediation Due Date2025-12-29

Ransomware UseUnknown

Affected Products

arraynetworks:ag1000arraynetworks:ag1000tarraynetworks:ag1000v5arraynetworks:ag1100arraynetworks:ag1100v5arraynetworks:ag1150arraynetworks:ag1200arraynetworks:ag1200v5arraynetworks:ag1500arraynetworks:ag1500fipsarraynetworks:ag1500v5arraynetworks:ag1600arraynetworks:ag1600v5arraynetworks:arrayos_agarraynetworks:vxag

Weaknesses (CWE)

CWE-78

References

https://www.bleepingcomputer.com/news/security/hackers-are-exploiting-arrayos-ag-vpn-flaw-to-plant-webshells/(cve@mitre.org)

https://www.jpcert.or.jp/at/2025/at250024.html(cve@mitre.org)

https://x.com/ArraySupport/status/1921373397533032590(cve@mitre.org)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-66644(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.