CVE-2025-66644

HIGHCISA KEV

7.2

Descricao

Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.

Detalhes CVE

Pontuacao CVSS v3.17.2

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosHIGH

Interacao do usuarioNONE

Publicado12/5/2025

Ultima modificacao12/10/2025

Fontekev

Avistamentos honeypot0

CISA KEV

FornecedorArray Networks

ProdutoArrayOS AG

Nome da vulnerabilidadeArray Networks ArrayOS AG OS Command Injection Vulnerability

Data inclusao KEV2025-12-08

Prazo de remediacao2025-12-29

Uso em ransomwareUnknown

Produtos afetados

arraynetworks:ag1000arraynetworks:ag1000tarraynetworks:ag1000v5arraynetworks:ag1100arraynetworks:ag1100v5arraynetworks:ag1150arraynetworks:ag1200arraynetworks:ag1200v5arraynetworks:ag1500arraynetworks:ag1500fipsarraynetworks:ag1500v5arraynetworks:ag1600arraynetworks:ag1600v5arraynetworks:arrayos_agarraynetworks:vxag

Fraquezas (CWE)

CWE-78

Referencias

https://www.bleepingcomputer.com/news/security/hackers-are-exploiting-arrayos-ag-vpn-flaw-to-plant-webshells/(cve@mitre.org)

https://www.jpcert.or.jp/at/2025/at250024.html(cve@mitre.org)

https://x.com/ArraySupport/status/1921373397533032590(cve@mitre.org)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-66644(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.