PT-2023-21733 · Array Networks · Array Networks Apv

Published 2023-03-15 · Updated 2023-03-24 · CVE-2023-28460

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Array Networks APV products versions prior to 8.6.1.262 Array Networks APV products versions prior to 10.4.2.93

Description A command injection issue was discovered in Array Networks APV products. A remote attacker can send a crafted packet after logging into the affected appliance as an administrator, resulting in arbitrary shell code execution.

Recommendations For versions prior to 8.6.1.262, update to version 8.6.1.262 or newer. For versions prior to 10.4.2.93, update to version 10.4.2.93 or newer.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2023-28460

Affected Products

Array Networks Apv

References · 5

• https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_Command_Injection_Vulnerabilities_APV_ID-133258.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28460 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28460 · Vendor Advisory
• https://t.me/cvenotify/46279 · Telegram Post
• https://t.me/cvenotify/46771 · Telegram Post