A command injection vulnerability was discovered in Array Networks APV products. A remote attacker can send a crafted packet after logging into the affected appliance as an administrator, resulting in arbitrary shell code execution. This is fixed in 8.6.1.262 or newer and 10.4.2.93 or newer.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00701.

Exploitation none

Automatable no

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
n/a n/a affected
Version Status Constraints
n/a affected —

Configuration 1 [-]

AND
OR cpe:2.3:o:arraynetworks:array_os:*:*:*:*:*:*:*:*
cpe:2.3:o:arraynetworks:array_os:*:*:*:*:*:*:*:*
cpe:2.3:o:arraynetworks:array_os:*:*:*:*:*:*:*:*
cpe:2.3:o:arraynetworks:array_os:10.4.3.2:*:*:*:*:*:*:*
OR cpe:2.3:h:arraynetworks:apv10650:-:*:*:*:*:*:*:*
cpe:2.3:h:arraynetworks:apv11600:-:*:*:*:*:*:*:*
cpe:2.3:h:arraynetworks:apv1600:-:*:*:*:*:*:*:*
cpe:2.3:h:arraynetworks:apv1600t:-:*:*:*:*:*:*:*
cpe:2.3:h:arraynetworks:apv1600v5:-:*:*:*:*:*:*:*
cpe:2.3:h:arraynetworks:apv1800:-:*:*:*:*:*:*:*
cpe:2.3:h:arraynetworks:apv2600:-:*:*:*:*:*:*:*
cpe:2.3:h:arraynetworks:apv2600v5:-:*:*:*:*:*:*:*
cpe:2.3:h:arraynetworks:apv2800:-:*:*:*:*:*:*:*
cpe:2.3:h:arraynetworks:apv3600:-:*:*:*:*:*:*:*
cpe:2.3:h:arraynetworks:apv3600v5:-:*:*:*:*:*:*:*
cpe:2.3:h:arraynetworks:apv3650:-:*:*:*:*:*:*:*
cpe:2.3:h:arraynetworks:apv5600:-:*:*:*:*:*:*:*
cpe:2.3:h:arraynetworks:apv5800:-:*:*:*:*:*:*:*
cpe:2.3:h:arraynetworks:apv6600:-:*:*:*:*:*:*:*
cpe:2.3:h:arraynetworks:apv6600fips:-:*:*:*:*:*:*:*
cpe:2.3:h:arraynetworks:apv7600:-:*:*:*:*:*:*:*
cpe:2.3:h:arraynetworks:apv7800:-:*:*:*:*:*:*:*
cpe:2.3:h:arraynetworks:apv800:-:*:*:*:*:*:*:*
cpe:2.3:h:arraynetworks:vapv:-:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Arraynetworks Subscribe
Apv10650 Subscribe
Apv11600 Subscribe
Apv1600 Subscribe
Apv1600t Subscribe
Apv1600v5 Subscribe
Apv1800 Subscribe
Apv2600 Subscribe
Apv2600v5 Subscribe
Apv2800 Subscribe
Apv3600 Subscribe
Apv3600v5 Subscribe
Apv3650 Subscribe
Apv5600 Subscribe
Apv5800 Subscribe
Apv6600 Subscribe
Apv6600fips Subscribe
Apv7600 Subscribe
Apv7800 Subscribe
Apv800 Subscribe
Array Os Subscribe
Vapv Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2023-32139 A command injection vulnerability was discovered in Array Networks APV products. A remote attacker can send a crafted packet after logging into the affected appliance as an administrator, resulting in arbitrary shell code execution. This is fixed in 8.6.1.262 or newer and 10.4.2.93 or newer.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_Command_Injection_Vulnerabilities_APV_ID-133258.pdf cve-icon cve-icon
History

Tue, 04 Mar 2025 03:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2025-02-27T14:18:37.236Z

Reserved: 2023-03-15T00:00:00.000Z

Link: CVE-2023-28460

cve-icon Vulnrichment

Updated: 2024-08-02T12:38:25.363Z

cve-icon NVD

Status : Modified

Published: 2023-03-15T23:15:10.013

Modified: 2024-11-21T07:55:07.767

Link: CVE-2023-28460

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses