What’s Vulnerable › Vulnerabilities

CVE-2022-42897

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-10-13 · updated 2026-06-17
• Weakness: CWE-77

Description

Array Networks AG/vxAG with ArrayOS AG before 9.4.0.469 allows unauthenticated command injection that leads to privilege escalation and control of the system. NOTE: ArrayOS AG 10.x is unaffected.

Affected products

• Array Networks ArrayOS AG: through 9.4.0.469

References

• https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_Remote_Injection_Vulnerability_in_Array_VPN_Product_ID-11961_%20V2.1.pdf
• https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/fieldnotices.html
• https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_Remote_Injection_Vulnerability_in_Array_VPN_Product_ID-11961_%20V2.1.pdf
• https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/fieldnotices.html

Get alerted when CVE-2022-42897 or the next vulnerability affects your stack