JPCERT Confirms Active Command Injection Attacks on Array AG Gateways
Source Reddit InfoSec News
Description
JPCERT has confirmed active command injection attacks targeting Array AG Gateway devices. These attacks allow remote adversaries to execute arbitrary commands on vulnerable gateways, potentially leading to full system compromise. The threat is considered high severity due to the critical role these gateways play in network security and traffic management. Although no specific affected versions or patches have been disclosed yet, organizations using Array AG Gateways should be vigilant. The attacks do not currently have known public exploits but are actively observed in the wild. European organizations relying on these gateways for secure remote access and traffic control are at risk of confidentiality, integrity, and availability breaches. Immediate mitigation involves monitoring network traffic for anomalies, restricting access to management interfaces, and applying any forthcoming vendor advisories. Countries with significant deployments of Array AG Gateways and critical infrastructure sectors are more likely to be targeted. Given the ease of exploitation via command injection and the potential for broad impact, the suggested severity is high. Defenders should prioritize detection and containment efforts to prevent lateral movement and data exfiltration.