CVE-2025-66644 is an OS command injection vulnerability in Array Networks ArrayOS AG. CISA added it to the Known Exploited Vulnerabilities catalogue on 8 December 2025, which means attackers have used it in real attacks. Array Networks ArrayOS AG contains an OS command injection vulnerability that could allow an attacker to execute arbitrary commands.
What This Vulnerability Means in Practice
os command injection in an edge appliance means attacker-controlled input can reach the operating system shell. On a device that sits in front of internal services, that is especially dangerous because it can turn a management, VPN, or gateway flaw into direct system-level execution.
For a vulnerability of this type, the core issue is not just malformed input, but loss of trust in the appliance’s command boundary. Once shell execution is possible, an attacker may be able to read configuration, alter routing or authentication behaviour, drop a web shell, or use the device as a pivot point into adjacent systems.
Why Edge Appliances Make Command Injection High Impact
ArrayOS AG is the sort of product that often has elevated reach into networks, credentials, and remote access paths. That makes command injection more than a local bug, because the affected system may already hold trusted network position, administrative functions, or sensitive session material.
This is why command injection on perimeter infrastructure is frequently treated as a high-severity weakness even before exploit details are known. The danger comes from the combination of privileged placement, exposed attack surface, and the ability to translate a single request into arbitrary commands. For broader context on command injection patterns and how they are abused, see Web Application Attacks Guide.
How Organisations Check Exposure and Reduce Blast Radius
Exposure review starts with asset inventory: identify every Array Networks ArrayOS AG instance, where it is deployed, whether it is internet-facing, and whether it supports remote access or administrative workflows. Because exploitation has been observed in real attacks, organisations should also confirm whether the product appears in the CVE Program record and the NIST National Vulnerability Database entry, then compare that with vendor guidance for exact remediation steps.
If patching cannot happen immediately, compensating controls matter: restrict administrative access, remove direct internet exposure where possible, constrain management interfaces to trusted networks, and monitor for anomalous command execution or configuration changes. Vulnerability Management Guide is useful here because it ties KEV-style prioritisation to practical remediation workflow, verification, and exception handling.
Detection and Post-Exploitation Review After Patching
Once a command injection flaw is exploited, the attacker may leave behind persistence, alter scripts, create accounts, or manipulate configuration so access survives remediation. Patching alone does not prove the device is clean if compromise occurred before the fix.
After exposure is addressed, review logs for suspicious command strings, unexpected child processes, new scheduled tasks, modified startup items, and unusual outbound connections from the appliance. Also verify whether credentials, session tokens, API keys, or administrative secrets stored on or reachable from the device could have been harvested and should be rotated.
Risk and Threat Considerations
Command injection on a perimeter or gateway appliance creates a direct path from crafted input to system execution, which means the attacker may be able to use the device as an entry point, persistence foothold, or pivot into internal services. Because the product is already trusted by the network, compromise can have outsized blast radius.
Failure mechanism: Unsanitised input reaches a command interpreter or shell wrapper, allowing the attacker to run arbitrary system commands under the appliance’s privileges.
Impact: The attacker may steal configuration, alter access control, deploy malware, pivot deeper into the environment, or retain access even after the initial vulnerability is patched.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | Command injection is prevented by validating and constraining input before command execution. |
| RA-5 — Vulnerability Monitoring and Scanning | KEV-listed exploitation requires asset discovery, exposure review, and remediation tracking. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Post-exploitation review depends on analysing logs for command execution and tampering. | |
| Recommendation — Enforce SI-10 to block untrusted input from reaching operating-system commands. Use RA-5 to identify exposed ArrayOS AG assets and track remediation to completion. Apply AU-6 to review appliance logs for suspicious commands and configuration changes. | ||
| OWASP ASVS | V15 — Secure Coding and Architecture | OS command injection is a classic secure-architecture failure in input handling and process execution. |
| Recommendation — Apply V15 to prevent shell execution from untrusted application input. | ||
Practitioner Guidance
Why practitioners should care: For KEV-listed command injection on exposed infrastructure, speed matters because exploitation can be immediate and high impact. Treat affected appliances as potentially hostile until exposure is contained and integrity is checked.
Practitioner takeaway: Pair vendor remediation with log review and secret rotation, because an exploited edge device is often an access path, not just a patched asset.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org