CVE-2025-66644 Array Networks ArrayOS AG OS Command Injection
Attackers can execute arbitrary commands on Array Networks ArrayOS AG devices, leading to full system compromise.
- Exploited in the wild
- Since 8 Dec 2025
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-66644?
CVE-2025-66644 is a high-severity command injection vulnerability in ArrayOS AG, published on 5 Dec 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.
Weakness: CWE-78
Which versions are affected by CVE-2025-66644?
It affects 1 product.
Products include Arraynetworks Arrayos Ag.
How do I fix CVE-2025-66644?
No fix has been published for CVE-2025-66644 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 29 Dec 2025.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-66644 being exploited?
Yes. Attackers have exploited CVE-2025-66644 in the wild since at least 8 Dec 2025.
Other vulnerabilities in ArrayOS AG
Sources
Also known as GHSA-hqfm-g725-ccqr.