CVE-2023-28461 (Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function)

What this vulnerability means in an appliance

Missing authentication for a critical function means the product exposes an administrative or operational capability without properly proving who is calling it. In an edge appliance, that is especially dangerous because the vulnerable function may sit close to the trust boundary and can often be reached before deeper controls ever see the request.

For products in this class, the issue is not just unauthorized access in the abstract, but the possibility that a remote attacker can reach high-impact functions that were meant to be reserved for authenticated administrators. That can turn a network appliance from a control point into an entry point.

How exposure is typically assessed

Organisations first need an accurate inventory of every instance of the affected Array Networks AG or vxAG ArrayOS deployment, including any externally reachable management or gateway interfaces. The practical question is not only whether the software exists somewhere in the estate, but whether the vulnerable function is exposed on paths an attacker can reach.

Vendor advisories and the CVE Program record should be used to confirm the exact vulnerability record, while the NIST National Vulnerability Database is the place to check the canonical CVE entry and associated reference data. For exploitation urgency, the CISA cyber threat advisories page and the KEV catalogue context matter because this CVE was added to KEV, which means defenders should treat exposure as active rather than theoretical.

Remediation and compensating controls

Priority should be given to the vendor fix or the vendor’s documented mitigation path, because missing authentication defects are usually not safely contained by policy alone. If the appliance cannot be patched immediately, organisations should reduce exposure by restricting network reachability, especially from untrusted or internet-routable segments, and by removing unnecessary access paths to the vulnerable interface.

Compensating controls are about shrinking the attack surface, not pretending the defect is gone. That can include limiting source IPs, placing the interface behind a stronger access boundary, and increasing scrutiny on any administrative function that the appliance exposes while the issue remains unpatched.

Detection and post-exploitation review

Because this class of flaw can enable unauthenticated access to sensitive functions, defenders should review logs for unusual requests to the appliance, unexpected configuration changes, and any signs that management actions occurred without a corresponding authenticated administrator session. If the product was internet-facing, review should be treated as urgent even when no obvious alert fired.

After patching, the post-incident question is whether the appliance was used as a foothold. That means checking for altered configuration, suspicious accounts or session artefacts, unexpected outbound connections, and any broader signs that the device was leveraged to reach adjacent systems. For a gateway or perimeter appliance, compromise review should extend beyond the appliance itself because it may have been used to pivot further into the environment.

Risk and Threat Considerations

Missing authentication on a critical function is dangerous because it can collapse the trust boundary that the appliance is supposed to enforce. When the exposed function is reachable remotely, an attacker may be able to invoke privileged behaviour directly, without credentials, which makes initial access faster and easier to automate.

Failure mechanism: The vulnerable function accepts a request without the authentication step that should gate administrative or security-sensitive actions, allowing unauthorised control or information exposure.

Impact: Attackers can change configuration, gain privileged access, or use the appliance as a launch point for follow-on compromise, including persistence or lateral movement into connected networks.

Practitioner Guidance

Why practitioners should care: Treat this as a perimeter-exposure issue, not a routine software defect. When a network appliance loses authentication on a critical function, the business impact can spread quickly because the device often sits in a position of high trust and broad reach.

What to watch for: Focus on whether the vulnerable interface is reachable from the internet or from broad internal segments, whether the device has privileged administrative capability, and whether any configuration or access events occurred during the exposure window.

Practitioner takeaway: Prioritise patching, then assume compromise is possible until logging, configuration, and surrounding systems have been reviewed.

Related resources from NHI Mgmt Group

• CVE-2025-32433 (Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function)
• CVE-2025-66644 (Array Networks ArrayOS AG OS Command Injection)
• What happens when mandatory multi-factor authentication is missing on critical systems?
• How should security teams respond when a public-facing Fortinet appliance is exposed to a critical vulnerability like CVE-2023-27997?