A command injection vulnerability in Array Networks AG series secure access gateways has been exploited since August 2025, according to an alert issued by JPCERT/CC this week.
This vulnerability, which does not have a CVE identifier, was resolved by the company on May 11, 2025. The vulnerability is rooted in Array’s DesktopDirect, a remote desktop access solution that allows users to securely access their work computers from anywhere.
JPCERT/CC states, “If this vulnerability is exploited, an attacker may be able to execute arbitrary commands.” “This vulnerability affects systems that have the ‘DesktopDirect’ feature, which provides remote desktop access, enabled.”
The agency said it has confirmed an incident in Japan that exploited this vulnerability to drop a web shell on susceptible devices starting in August 2025. The attack originated from the IP address 194.233.100.[.]138″
At this time, details regarding the scale of the attack, the weaponization of the flaw, and the identity of the attackers exploiting it are not available.
However, an authentication bypass flaw (CVE-2023-28461, 9.8) in the same product was exploited last year by a China-linked cyber-espionage group called MirrorFace, which has a history of targeting Japanese organizations since at least 2019. However, there is currently no evidence to suggest that any threat actor may be involved in this series of attacks.
This vulnerability affected ArrayOS versions 9.4.5.8 and earlier and was resolved in ArrayOS version 9.4.5.9. Users are advised to apply the latest updates as soon as possible to mitigate potential threats. If patching is not immediately possible, JPCERT/CC states that it is recommended to disable the DesktopDirect service and use URL filtering to deny access to URLs containing semicolons.
Source link
