CVE-2023-28461: Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability

CVE-2023-28461 is a missing authentication for critical function vulnerability in Array Networks AG and vxAG ArrayOS. It allows an unauthenticated attacker to read local files and execute code on the SSL VPN gateway. Because this product class sits at the network edge and the vulnerability is known to be used by ransomware operators, unpatched gateways present a direct path for initial access and follow-on compromise.

Defenders should treat any internet-facing Array Networks SSL VPN instance as high priority until the vendor-recommended mitigations are confirmed in place or the product is removed from service.

How it works

The underlying weakness is CWE-306: missing authentication for a critical function. In this case, certain functions on the Array Networks AG/vxAG ArrayOS SSL VPN gateway do not properly require authentication before allowing sensitive operations. An attacker who can reach the gateway can therefore invoke those functions without credentials.

According to the CISA summary, successful abuse lets the attacker read local files on the device and execute code. Exact request formats, endpoints, or payload details are not provided here; treat any unauthenticated access to administrative or diagnostic interfaces on these gateways as potentially exploitable and confirm the precise attack surface against the vendor advisory.

Am I affected? How to find it in your systems

Array Networks AG and vxAG ArrayOS appliances commonly function as SSL VPN gateways, often placed at the perimeter to terminate remote-access sessions. Inventory every device that presents an Array Networks SSL VPN service, whether physical, virtual, or cloud-hosted.

• Query asset management, CMDB, and network discovery tools for Array Networks hardware or virtual appliances running ArrayOS.
• Scan external and internal IP ranges for SSL VPN portals that identify as Array Networks products; note management interfaces as well as user portals.
• Compare the installed ArrayOS version and configuration against the vendor advisory for CVE-2023-28461; public detail on exact affected builds is limited, so rely on the vendor’s list.
• Review authentication and access logs for unexpected unauthenticated requests to administrative or file-related endpoints, spikes in local file-access activity, or anomalous process execution on the gateway itself. Absence of such logs does not prove safety; many appliances log incompletely by default.

How to remediate

The primary remediation is to apply the mitigations or updates specified by Array Networks for CVE-2023-28461. CISA’s required action is explicit: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

• Obtain the current vendor advisory and apply every listed patch, configuration change, or workaround without delay.
• After remediation, re-verify that the previously exposed critical functions now enforce authentication and that file-read and code-execution paths are no longer reachable without credentials.
• If the vendor indicates that a particular build cannot be secured, plan an orderly decommission and replacement of the gateway.
• Document the change and retain evidence of the applied fix for audit and incident-response purposes.

If you can't patch immediately

Until the vendor fix is installed, reduce exposure with compensating controls typical for missing-authentication flaws on edge VPN devices.

• Segment the gateway so that only necessary management stations can reach administrative interfaces; block all other sources at the firewall.
• If a web application firewall or reverse-proxy is available, apply virtual-patching rules that deny unauthenticated requests matching the patterns described in the vendor advisory.
• Disable any non-essential diagnostic, file-transfer, or administrative features that the advisory associates with the vulnerability.
• Increase monitoring: alert on any unauthenticated access attempts, unexpected file reads, or new process creation on the appliance; forward logs to a SIEM for correlation with ransomware indicators.
• Consider temporary removal of the device from internet exposure if business requirements allow, routing remote access through an alternative, fully patched VPN solution.

If your data may have been exposed

Actively exploited vulnerabilities of this class frequently lead to ransomware deployment and data theft. If logs or other indicators suggest compromise, assume the gateway and any systems reachable through it may have been accessed. Rotate credentials that traversed the VPN, examine connected hosts for lateral movement, and follow your incident-response plan. You can also run a free exposure scan of your email addresses to check whether related credentials or personal data already appear in known breach collections.