Array Networks ArrayOS AG OS Command Injection Vulnerability

Array Networks ArrayOS AG

Array Networks ArrayOS AG contains an OS command injection vulnerability that could allow an attacker to execute arbitrary commands. Added to CISA KEV on 2025-12-08 (federal deadline 2025-12-29).

First seen: 8 Dec 2025
Last update: 8 Dec 2025, 12:00 UTC
Identifiers: CVE-2025-66644
Source: CISA KEV

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Array Networks ArrayOS AG OS Command Injection Vulnerability
Severity: high, exploited in the wild. Patch status: patched.
Affected: Array Networks ArrayOS AG
Ids: CVE-2025-66644

Array Networks ArrayOS AG contains an OS command injection vulnerability that could allow an attacker to execute arbitrary commands. Added to CISA KEV on 2025-12-08 (federal deadline 2025-12-29).

## Steps
1. Search the repo, its CI and infra config for Array Networks ArrayOS AG. If present, report the version in use and whether it's affected.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2025-66644") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2025-66644 https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/ag.html https://www.jpcert.or.jp/at/2025/at250024.html
https://pwned.coffee/i/array-networks-arrayos-ag-os-command-injection-vulnerabi-cve-2025-66644

Sources

Totalone hot coffee