OS command injection in ArrayOS AG
Priority CRITICAL 100Exploited in the wildCWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.
Summary
Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.
Why it matters now
Exploitation Active In CISA KEV since 2025-12-08CISA due date 2025-12-29
EPSS 0.0333 88th percentileScored 2026-11-07
Fix Fixed ArrayOS AG (Array Networks): 9.4.5.9
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Array Networks | ArrayOS AG | before 9.4.5.9 | 9.4.5.9 | Patch available | CNA |
- ArrayOS AG VendorArray Networks Affected before 9.4.5.9 Fixed in 9.4.5.9 Patch available CNA
CPE configurations NVD · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:arraynetworks:arrayos_ag:*:*:*:*:*:*:*:* | before 9.4.5.9 | Vulnerable | Array Networks |
| cpe:2.3:h:arraynetworks:ag1000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Array Networks |
| cpe:2.3:h:arraynetworks:ag1000t:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Array Networks |
| cpe:2.3:h:arraynetworks:ag1000v5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Array Networks |
| cpe:2.3:h:arraynetworks:ag1100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Array Networks |
| cpe:2.3:h:arraynetworks:ag1100v5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Array Networks |
| cpe:2.3:h:arraynetworks:ag1150:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Array Networks |
| cpe:2.3:h:arraynetworks:ag1200:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Array Networks |
| cpe:2.3:h:arraynetworks:ag1200v5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Array Networks |
| cpe:2.3:h:arraynetworks:ag1500:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Array Networks |
- cpe:2.3:o:arraynetworks:arrayos_ag:*:*:*:*:*:*:*:* Versions before 9.4.5.9 Vulnerable ·Array Networks
- cpe:2.3:h:arraynetworks:ag1000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Array Networks
- cpe:2.3:h:arraynetworks:ag1000t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Array Networks
- cpe:2.3:h:arraynetworks:ag1000v5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Array Networks
- cpe:2.3:h:arraynetworks:ag1100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Array Networks
- cpe:2.3:h:arraynetworks:ag1100v5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Array Networks
- cpe:2.3:h:arraynetworks:ag1150:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Array Networks
- cpe:2.3:h:arraynetworks:ag1200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Array Networks
- cpe:2.3:h:arraynetworks:ag1200v5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Array Networks
- cpe:2.3:h:arraynetworks:ag1500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Array Networks
Show 5 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:arraynetworks:ag1500fips:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Array Networks |
| cpe:2.3:h:arraynetworks:ag1500v5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Array Networks |
| cpe:2.3:h:arraynetworks:ag1600:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Array Networks |
| cpe:2.3:h:arraynetworks:ag1600v5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Array Networks |
| cpe:2.3:h:arraynetworks:vxag:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Array Networks |
- cpe:2.3:h:arraynetworks:ag1500fips:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Array Networks
- cpe:2.3:h:arraynetworks:ag1500v5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Array Networks
- cpe:2.3:h:arraynetworks:ag1600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Array Networks
- cpe:2.3:h:arraynetworks:ag1600v5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Array Networks
- cpe:2.3:h:arraynetworks:vxag:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Array Networks
Remediation
- Fix · CNA ArrayOS AG (Array Networks) Fixed in 9.4.5.9
Timeline
- 2025-12-08 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2025-66644
- 2026-10-03 Alias added: GHSA-hqfm-g725-ccqr
References
More Array Networks Arrayos Ag vulnerabilities
- TI-2023-13002 Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code… KEVCVSS 3.1CRITICAL 9.8
- TI-2022-20893 Array Networks AG/vxAG with ArrayOS AG before 9.4.0.469 allows unauthenticated command… CVSS 3.1CRITICAL 9.8
- TI-2023-28350 MotionPro in Array ArrayOS AG before 9.4.0.505 on AG and vxAG allows remote command… CVSS 3.1CRITICAL 9.8
- TI-2023-21742 Array AG OS before 9.4.0.499 allows denial of service: remote attackers can cause system… CVSS 3.1HIGH 7.5
- TI-2023-10226 The user interface of Array Networks AG Series and vxAG through 9.4.0.470 could allow a… CVSS 3.1MEDIUM 4.9
Sources
- CVE-2025-66644 · CVE Program
- CVE-2025-66644 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-hqfm-g725-ccqr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences