Hackers are exploiting ArrayOS AG VPN flaw to plant webshells
Recorded: Dec. 5, 2025, 1:02 a.m.
| Original | Summarized |
Hackers are exploiting ArrayOS AG VPN flaw to plant webshells News Featured Critical React, Next.js flaw lets hackers execute code on servers North Korea lures engineers to rent identities in fake IT worker scheme CISA warns of Chinese "BrickStorm" malware attacks on VMware servers Marquis data breach impacts over 74 US banks, credit unions Hackers are exploiting ArrayOS AG VPN flaw to plant webshells NCSC's ‘Proactive Notifications’ warns orgs of flaws in exposed devices Predator spyware uses new infection vector for zero-click attacks Russia blocks FaceTime and Snapchat for alleged use by terrorists Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityHackers are exploiting ArrayOS AG VPN flaw to plant webshells Hackers are exploiting ArrayOS AG VPN flaw to plant webshells By Bill Toulas December 4, 2025 Threat actors have been exploiting a command injection vulnerability in Array AG Series VPN devices to plant webshells and create rogue users. “Because this product’s user base is concentrated in Asia and most of the observed attacks are in Japan, security vendors and security organizations outside Japan have not been paying close attention,” Sejiyama told BleepingComputer. Break down IAM silos like Bitpanda, KnowBe4, and PathAI Related Articles: Actively Exploited Bill Toulas Previous Article Post a Comment Community Rules You need to login in order to post a comment Not a member yet? Register Now You may also like: Popular Stories ChatGPT is down worldwide, conversations disappeared for users Marquis data breach impacts over 74 US banks, credit unions North Korea lures engineers to rent identities in fake IT worker scheme Sponsor Posts Overdue a password health-check? Audit your Active Directory for free Hackers love the holidays! Share FREE Security Awareness Training to keep family & friends cyber-safe! AI is a data-breach time bomb: Read the new report Empowering IT teams with intelligence driven cyber threat research. Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2025 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
Hackers are actively exploiting a command injection vulnerability within ArrayOS AG VPN devices, specifically versions 9.4.5.8 and earlier, to deploy webshells and establish unauthorized user accounts. This activity, reported by Japan’s Computer Emergency Response Team (JPCERT/CC), has been ongoing since at least August 2025, with a significant concentration of attacks originating from the IP address 194.233.100[.]138, also utilized for communication. The attackers are targeting hosts utilizing the “DesktopDirect” remote access feature, which is commonly found in Array OS Series hardware and virtual appliances facilitating secure remote access to corporate networks. The initial vector of attack leverages a command injection flaw within the webapp path /ca/aproxy/webapp/, resulting in the placement of a PHP webshell file. This vulnerability’s presence highlights a potential security gap in Array Networks’ VPN offering, particularly for organizations relying on this technology for secure remote access. At the time of the reporting, researcher Yutaka Sejiyama of Macnica’s security research team, identified over 1,831 instances of ArrayAG globally, predominantly in China, Japan, and the United States. Sejiyama’s scans revealed that at least 11 hosts active with the DesktopDirect feature, indicating a potential for wider exposure. The ongoing exploitation underscores a critical concern, especially considering the reliance of Array Networks’ AG Series VPN solutions by large organizations and enterprises. These gateways, based on SSL VPNs, typically provide encrypted tunnels to protect sensitive corporate resources such as networks, applications, desktops, and cloud services. Detection of this vulnerability within a product that supports this critical connectivity function means organizations face potential compromises in their security posture. Notably, Array Networks had addressed this vulnerability in version 9.4.5.9, but the continuous exploitation emphasizes the need for prompt patching and implementation of security best practices. The JPCERT/CC recommends a workaround if upgrading is not immediately feasible: disabling all DesktopDirect services or employing URL filtering to block access to URLs containing semicolons. The situation is complicated by the lack of a CVE ID assigned by Array Networks, making tracking and remediation efforts more challenging. Further complicating the response is Sejiyama’s observation that security teams outside Japan had not closely monitored this product’s user base, contributing to the prolonged vulnerability window. This incident reinforces the importance of organizations to remain vigilant and proactive in identifying and mitigating potential vulnerabilities in their critical infrastructure components. Furthermore, it highlights the need for robust vulnerability management programs that encompass timely patching, continuous monitoring, and thorough security assessments. The absence of a CVE ID underscores the need for manufacturers to promptly publish vulnerability information and provide clear guidance to their user base, particularly regarding critical flaws that are actively being exploited. The exploit presents a potential risk to users of ArrayOS AG VPN series devices. |