Today's cybersecurity headlines are brought to you by ThreatPerspective

CISA Adds Array Networks AG and vxAG ArrayOS Flaw to its Known Exploited Vulnerabilities Catalog: A Cautionary Tale of Cybersecurity Negligence

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Array Networks AG and vxAG ArrayOS flaw CVE-2023-28461 (CVSS score: 9.8) to its Known Exploited Vulnerabilities catalog, urging federal agencies to address the vulnerability by December 16, 2024. This incident highlights the ongoing struggle against cyber threats and emphasizes the importance of proper cybersecurity governance.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently added Array Networks AG and vxAG ArrayOS flaw CVE-2023-28461 (CVSS score: 9.8) to its Known Exploited Vulnerabilities (KEV) catalog, a move that highlights the ongoing struggle against cyber threats in the digital age.

Array Networks' AG Series and vxAG (versions 9.4.0.481 and earlier) are impacted by a remote code execution vulnerability, which allows attackers to exploit the SSL VPN gateway by accessing the filesystem via an HTTP header flags attribute and a vulnerable URL without authentication.

This vulnerability was first identified in May 2023, when security researchers discovered that Array Networks' products were susceptible to a remote code execution vulnerability. However, it wasn't until November 26, 2024, that CISA added the flaw to its KEV catalog, indicating that the agency has been keeping tabs on the issue and is now urging federal agencies to address the vulnerability.

The binding operational directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities requires federal agencies to fix this vulnerability by December 16, 2024. This directive aims to protect networks against attacks exploiting the flaws in the catalog and emphasizes the importance of agency preparedness.

Experts also recommend that private organizations review the CISA's KEV catalog and address the vulnerabilities in their infrastructure. By doing so, they can mitigate potential risks and ensure the security of their systems.

The addition of this flaw to the CISA's KEV catalog serves as a reminder of the ongoing cyber threat landscape. As cybersecurity threats continue to evolve, it is essential for organizations to stay vigilant and take proactive measures to protect themselves against emerging vulnerabilities.

Moreover, this incident highlights the importance of proper cybersecurity governance and the need for agencies to prioritize vulnerability management. By taking swift action to address known exploited vulnerabilities, agencies can reduce the risk of successful cyber attacks and minimize the impact on their networks.

In recent months, there have been numerous high-profile breaches and incidents that have highlighted the ongoing struggles against cyber threats. The breach of sensitive information from Indian politics and the targeted ransomware attacks on several major corporations are just a few examples of the ever-evolving threat landscape.

CISA's efforts to identify and address known exploited vulnerabilities are crucial in protecting federal agencies' networks against cyber threats. By taking proactive measures, CISA can help prevent successful attacks and ensure the security of the nation's critical infrastructure.

In conclusion, the addition of Array Networks AG and vxAG ArrayOS flaw to CISA's KEV catalog serves as a timely reminder of the ongoing importance of cybersecurity awareness and preparedness. As the threat landscape continues to evolve, it is essential for organizations to prioritize vulnerability management and take proactive measures to protect themselves against emerging vulnerabilities.