Array Networks ArrayOS AG OS Command Injection Vulnerability (CVE-2025-66644) Urgent Security Advisory

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2025-66644) is an OS Command Injection vulnerability (CWE-78) residing within the management interface and input validation routines of Array Networks ArrayOS AG. The root cause is the failure of the system to properly sanitize and escape user-supplied inputs before passing them to system shell execution environments. Although exploiting this vulnerability requires high privileges (PR:H), it poses a critical risk as attackers who obtain administrative credentials or hijack active sessions can gain unrestricted shell access to the underlying operating system.

2. Exploitation Mechanics & Attack Scenario

In-the-wild exploitation of this vulnerability was actively observed between August and December 2025. In a typical attack scenario, threat actors first obtain administrative access to the ArrayOS AG management console via credential stuffing, session hijacking, or other credential compromise vectors. Once authenticated, they inject malicious shell metacharacters (such as ';', '&', or backticks) along with arbitrary commands into vulnerable input fields or API parameters. The system executes these commands with root privileges, allowing attackers to plant persistent webshells and establish a foothold within the network.

3. Infrastructure & Business Impact

ArrayOS AG appliances serve as critical perimeter gateways, handling VPN connections and application delivery. Successful exploitation of this vulnerability allows attackers to bypass perimeter security controls and establish a direct entry point into the internal corporate network. This can lead to catastrophic consequences, including lateral movement, sensitive data exfiltration, and ransomware deployment. Due to its active exploitation status and inclusion in the CISA KEV catalog, this vulnerability poses an immediate threat to organizational infrastructure.