CVE-2025-66644

What it actually does

CVE-2025-66644 is an operating-system command injection vulnerability in Array Networks ArrayOS AG versions before 9.4.5.9. A remote attacker can submit crafted input to a vulnerable ArrayOS AG interface that is improperly passed to the underlying operating system, allowing attacker-controlled shell commands to execute with the privileges of the affected service. Given the CVSS 9.8 rating and known in-the-wild exploitation, the flaw should be treated as a critical remote compromise path for exposed ArrayOS AG appliances.

Why it matters to the business

Successful exploitation can give an attacker control of an application delivery or gateway appliance, enabling service disruption, traffic interception, credential theft, lateral movement, malware deployment, or use of the device as a foothold into internal networks. Because this vulnerability is listed in CISA KEV, has confirmed active exploitation from August through December 2025, and has a remediation deadline of 2025-12-29, organizations should prioritize remediation even though the EPSS score is moderate at 0.03462.

How an attack unfolds

An attacker first identifies an internet-accessible or reachable Array Networks ArrayOS AG appliance running a version earlier than 9.4.5.9. The attacker sends a crafted request containing shell metacharacters or command syntax to the vulnerable ArrayOS AG component. If the appliance is vulnerable, the unsanitized input is interpreted by the operating system rather than treated as data, causing commands to run on the appliance. The attacker may then validate execution using harmless commands, download tooling, create persistence, harvest configuration and credentials, pivot through trusted network paths, or disrupt application delivery services. Public reporting indicates this issue was exploited in the wild during August through December 2025, so defenders should assume exposed unpatched systems may have been targeted.

How to fix it

Upgrade Array Networks ArrayOS AG to version 9.4.5.9 or later. If immediate upgrade is not possible, restrict access to ArrayOS AG management and administrative interfaces to trusted administrative networks or VPN-only access, block direct internet exposure, enforce strong authentication, and apply vendor-recommended mitigations. Because this vulnerability is in CISA KEV, remediation should be completed no later than the KEV due date of 2025-12-29 where applicable. After patching, rotate credentials and secrets stored on or handled by the appliance if compromise is suspected.

How to confirm the fix worked

Confirm the running ArrayOS AG version is 9.4.5.9 or later using the appliance administrative interface, CLI, or vendor-supported inventory method. Validate that management interfaces are not exposed to untrusted networks. Review vulnerability scanner results and asset inventory to ensure no ArrayOS AG instances remain below 9.4.5.9. Where safe and authorized, use a non-destructive vendor-approved check or authenticated configuration review rather than live exploit testing. Confirm that compensating controls, such as management-plane ACLs and firewall rules, are in place for any appliance that cannot be immediately upgraded.

Typical attack path

1. Identify exposed Array Networks ArrayOS AG management or service interfaces.
2. Fingerprint the device and infer whether it is running ArrayOS AG before 9.4.5.9.
3. Send crafted input containing command-injection syntax to the vulnerable interface.
4. Confirm command execution through response content, timing behavior, outbound callbacks, or system artifacts.
5. Execute reconnaissance commands on the appliance, such as user, network, process, and configuration enumeration.
6. Download or stage additional tools using built-in utilities such as curl, wget, tftp, or shell redirection where available.
7. Establish persistence, collect credentials or configuration data, and use the appliance as a pivot point.
8. Cover tracks by deleting command history, temporary files, or relevant logs where possible.

How to detect it

To determine whether exploitation already occurred, review ArrayOS AG administrative, web access, audit, authentication, system, and network logs for suspicious requests containing shell metacharacters, URL-encoded command separators, or commands commonly used for reconnaissance and payload download. Look for unexpected outbound connections from the appliance to unfamiliar IP addresses or domains, especially shortly after unusual administrative requests. Examine process execution, shell invocation, temporary directories, cron or startup entries, new users, altered administrative accounts, changed configuration, and unexplained service restarts. Correlate failed and successful login activity with suspicious request timestamps. Because exploitation was observed in the wild from August through December 2025, retrospective hunting should cover at least that period and any later interval before patching. For devices that were internet-exposed and below 9.4.5.9, prioritize forensic collection and credential rotation if logs show command execution patterns or if logs are missing, truncated, or unexpectedly cleared.

• ;id
• %3Bid
• |id
• %7Cid
• &&id
• %26%26id
• ;whoami
• %3Bwhoami
• ;uname -a
• %3Buname%20-a
• ;cat /etc/passwd
• %3Bcat%20/etc/passwd
• ;wget
• %3Bwget%20
• ;curl
• %3Bcurl%20
• ;busybox
• %3Bbusybox%20
• ;nc
• %3Bnc%20
• ;netcat
• %3Bnetcat%20
• /bin/sh -c
• /bin/bash -c
• cmd=whoami
• cmd=id
• cmd=uname
• /tmp/.
• /var/tmp/.
• crontab -e
• /etc/cron
• /etc/passwd
• /etc/shadow

What your security team should do

• Immediately inventory all Array Networks ArrayOS AG appliances and identify versions earlier than 9.4.5.9.
• Patch or upgrade affected appliances to ArrayOS AG 9.4.5.9 or later as the top priority.
• Treat internet-exposed unpatched appliances as high-risk because exploitation has been observed in the wild and the issue is in CISA KEV.
• Restrict management and administrative interfaces to trusted networks only; remove public exposure wherever possible.
• Perform compromise assessment on any appliance that was exposed while vulnerable, focusing on command execution, suspicious outbound connections, new files, and configuration changes.
• Rotate administrative credentials, API keys, certificates, and other secrets if exploitation cannot be ruled out.
• Add SIEM detections for command-injection patterns, suspicious process execution, and outbound download or callback behavior from ArrayOS AG appliances.
• Preserve appliance logs and forensic artifacts before rebooting, rebuilding, or upgrading systems suspected of compromise.