Critical severity9.8CISA KEVNVD Advisory· Published Mar 15, 2023· Updated Aug 5, 2026

CVE-2023-28461

Description

Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated "a new Array AG release with the fix will be available soon."

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Arraynetworks/Arrayos Ag
cpe:2.3:o:arraynetworks:arrayos_ag:*:*:*:*:*:*:*:*
Range: <=9.4.0.481
Array Networks/Array AG Seriesdescription
Array Networks/Array AG Seriesllm-fuzzy
Range: <=9.4.0.481
Array Networks/vxAGllm-fuzzy
Range: <=9.4.0.481

Patches

Vulnerability mechanics

References

support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_for_Remote_Code_Execution_Vulnerability_AG.pdfnvdMitigationVendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.054
exploit	0.000
kev	0.120
patch	0.000
ransomware	0.060