High · published December 5, 2025
CVSS calls it high at 7.2. It is confirmed in active exploitation. It sits in the 88.8th percentile for exploit probability.
🚨 Command injection vulnerability in Array Networks ArrayOS AG before version 9.4.5.9 has been actively exploited since August 2025! ⚡ Think of it as a restaurant chef who can be tricked into preparing a dish they never intended to serve — the attacker just slips in a secret ingredient and suddenly, the chef is cooking up chaos instead of dinner! An attacker could send malicious commands that the system would execute, potentially giving them control over the device. This could lead to unauthorized access, data manipulation, or even a complete system takeover. The situation is absolutely devastating for your network's security!
Think of it as a restaurant chef who can be tricked into preparing a dish they never intended to serve — the attacker just slips in a secret ingredient and suddenly, the chef is cooking up chaos instead of dinner! This vulnerability allows attackers to inject harmful commands into the system's command line, ultimately executing arbitrary commands with the same privileges as the application itself.
An attacker could send malicious commands that the system would execute, potentially giving them control over the device. This could lead to unauthorized access, data manipulation, or even a complete system takeover. The situation is absolutely devastating for your network's security! Immediate action is required! Ensure you upgrade to ArrayOS AG version 9.4.5.9 or later. Additionally, review your security policies to prevent unauthenticated command execution and monitor your systems for any suspicious activity. You've got this! Implement these fixes and elevate your security hero status! 🛡️