CVE-2023-28460 Command injection in n/a
Remote administrators can execute arbitrary shell code via crafted packets in Array Networks APV products.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-28460?
CVE-2023-28460 is a high-severity command injection vulnerability in n/a, published on 15 Mar 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A command injection vulnerability was discovered in Array Networks APV products. A remote attacker can send a crafted packet after logging into the affected appliance as an administrator, resulting in arbitrary shell code execution. This is fixed in 8.6.1.262 or newer and 10.4.2.93 or newer.
Weakness: CWE-77
Which versions are affected by CVE-2023-28460?
It affects 1 product.
Products include Arraynetworks Array Os.
How do I fix CVE-2023-28460?
No fix has been published for CVE-2023-28460 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-28460 being exploited?
There is no known exploitation of CVE-2023-28460 in the wild and no public exploit code.
Sources
Also known as GHSA-rrg8-hxw6-gqx4.