JPCERT Confirms Active Command Injection Attacks on Array AG Gateways

AI-suggested

1. Immediately apply the vendor-released patch by upgrading to ArrayOS version 9.4.5.9 or later to remediate the vulnerability.
2. If immediate patching is not feasible, disable the DesktopDirect feature to eliminate the attack surface temporarily.
3. Implement URL filtering on network gateways and firewalls to block URLs containing semicolons, which are used in command injection payloads.
4. Conduct thorough network monitoring and endpoint detection for indicators of compromise, such as web shells or unusual command execution on Array AG gateways.
5. Restrict management and remote access interfaces to trusted IP addresses and enforce strong access controls.
6. Review and harden configurations related to remote desktop access solutions to minimize exposure.
7. Educate IT and security teams about this specific threat to ensure rapid detection and response.
8. Maintain up-to-date asset inventories to identify all affected devices and ensure comprehensive patching.
9. Consider deploying application-layer firewalls or intrusion prevention systems capable of detecting command injection attempts targeting DesktopDirect.
10. Collaborate with threat intelligence providers to stay informed about emerging exploitation tactics and indicators related to this vulnerability.