Detection Guidance

Detection involves investigating signs of compromise such as the presence of unauthorized PHP webshells in the /ca/aproxy/webapp/ directory and the creation of rogue users on the device. Network monitoring for suspicious traffic, especially communications to the IP address 194.233.100.138, which has been linked to attacks, is also recommended. While specific commands are not provided in the resources, typical steps include checking for unexpected files in the webapp directory, reviewing user accounts for unauthorized additions, and analyzing logs for unusual activity before rebooting the device, as rebooting may erase logs critical for investigation. [2, 3]

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to update ArrayOS AG to version 9.4.5.9, which contains the patch for this vulnerability. Before applying the update, preserve logs as rebooting the device may erase them. If updating is not immediately feasible, disable all DesktopDirect services if they are not in use and implement URL filtering to block URLs containing semicolons (';'), which are commonly used in the injection payloads. Following vendor and reseller guidance for investigation and countermeasures is also advised. [2, 3]

Useful 0 Not Useful 0

Executive Summary

This vulnerability is a command injection flaw in Array Networks ArrayOS AG versions before 9.4.5.9. It allows an attacker to execute arbitrary commands on the affected system. The vulnerability was actively exploited in the wild between August and December 2025.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can have a severe impact as it allows an attacker to execute arbitrary commands with high privileges, potentially leading to full compromise of the affected system. This can result in unauthorized access, data theft, service disruption, and other malicious activities.

Useful 0 Not Useful 0