"A command injection vulnerability in Array Networks AG Series secure access gateways has been exploited in the wild since August 2025, according to an alert issued by JPCERT/CC this week. The vulnerability, which does not have a CVE identifier, was addressed by the company on May 11, 2025. It's rooted in Array's DesktopDirect, a remote desktop access solution that allows users to securely access their work computers from any location."
""Exploitation of this vulnerability could allow attackers to execute arbitrary commands," JPCERT/CC said. "This vulnerability affects systems where the 'DesktopDirect' feature, which provides remote desktop access, is enabled." The agency said it has confirmed incidents in Japan that have exploited the shortcoming after August 2025 to drop web shells on susceptible devices. The attacks have originated from the IP address " 194.233.100[.]138.""
"The vulnerability impacts ArrayOS versions 9.4.5.8 and earlier, and has been addressed in version ArrayOS 9.4.5.9. Users are advised to apply the latest updates as soon as possible to mitigate potential threats. In case patching is not an immediate option, it's recommended to disable DesktopDirect services and use URL filtering to deny access to URLs containing a semicolon, JPCERT/CC said."
A command injection vulnerability in Array Networks AG Series secure access gateways permits execution of arbitrary commands when DesktopDirect is enabled. The flaw affected ArrayOS versions 9.4.5.8 and earlier and was fixed in ArrayOS 9.4.5.9 on May 11, 2025. Confirmed incidents in Japan since August 2025 used the vulnerability to drop web shells on vulnerable devices, with attacks traced to IP 194.233.100[.]138. No CVE identifier has been assigned and details on attack scale and actor identity remain unavailable. Mitigations include applying the 9.4.5.9 update, disabling DesktopDirect if patching is not possible, and using URL filtering to block semicolons.
Read at The Hacker News
Unable to calculate read time
Collection
[
|
...
]