Array AG series remote access appliances contain a command injection flaw in DesktopDirect

7 December 2025 critical vulnerability

Array AG series remote access appliances contain a command injection flaw in DesktopDirect; exploitation observed in Japan since August 2025, deploying PHP webshells.

Array Networks' AG series remote access products contain a command injection vulnerability in the DesktopDirect feature that allows unauthenticated attackers to execute arbitrary commands. Array Networks released patches in May 2025, but active exploitation has been observed in Japan since August 2025. Attackers have been confirmed deploying PHP webshells to compromised systems. The Japan Information-technology Promotion Agency (IPA) warns that attacks may escalate and urges immediate patching. Organisations using Array AG products are advised to review logs for indicators of compromise, preserve logs before patching (as system restart may cause log loss), and report suspected compromises to IPA. As a workaround, disabling the DesktopDirect feature mitigates the vulnerability. The advisory notes that associated IP addresses may belong to legitimate security research entities, and one listed address was later identified as belonging to an overseas security organisation and removed from the advisory.

Mentioned in this report

Vulnerabilities CVE-2025-0024

Detection guidance

Web Server Process Spawning Shell Interpreter (Possible Command Injection)

ATT&CK T1190

Detects a web/application server process (e.g. httpd, php-fpm, nginx) spawning a shell interpreter, consistent with exploitation of a command injection vulnerability such as the Array AG DesktopDirect flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Process Spawning Shell Interpreter
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains:
    - httpd
    - apache2
    - nginx
    - php-fpm
    - php
  shell:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /ash
  condition: selection and shell
falsepositives:
- Legitimate CGI scripts or application code intentionally invoking shell commands
  via system()/exec()
- Custom web application health-check or deployment scripts that shell out from the
  web server user context
level: high
tags:
- attack.t1190
- attack.t1059
id: fc25c3ce-3534-564b-99c1-6a2a114acac8
status: experimental
author: Vorant

PHP Webshell File Written by Web Server Process

ATT&CK T1505.003

Detects creation of a new PHP file by a web/application server process, consistent with webshell deployment following successful exploitation of a command injection vulnerability like the Array AG DesktopDirect flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: PHP File Created By Web Server Process
logsource:
  category: file_event
  product: linux
detection:
  selection:
    Image|contains:
    - httpd
    - apache2
    - nginx
    - php-fpm
    TargetFilename|endswith: .php
  condition: selection
falsepositives:
- Legitimate application deployment or update processes that write PHP files as part
  of normal operation
- CMS or plugin auto-update mechanisms running under the web server account
level: high
tags:
- attack.t1505.003
- attack.t1190
id: c9b6b4c1-6dad-5399-ad76-950a4c9a923c
status: experimental
author: Vorant

Reconnaissance Commands Executed by Web Server Process

ATT&CK T1059

Detects common post-exploitation reconnaissance commands (id, whoami, uname, wget, curl) executed with a web server or PHP process as parent, indicating command execution via an injected webshell or command injection vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Recon Commands Spawned From Web Server Process
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains:
    - httpd
    - apache2
    - nginx
    - php-fpm
    - php
  cmds:
    CommandLine|contains:
    - whoami
    - 'id '
    - uname
    - 'wget '
    - 'curl '
    - /etc/passwd
  condition: selection and cmds
falsepositives:
- Legitimate monitoring or health-check scripts invoked from the web server context
  that call system utilities
- Administrative tooling that shells out from a CGI or PHP handler for diagnostic
  purposes
level: medium
tags:
- attack.t1059
- attack.t1190
id: db1f8e43-e732-52ec-a235-1dd937690596
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2025/20251208.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free