CISA Alert on Critical Array Networks Flaws: Threat Explainer, Indian Legal Remedies, and Incident Reporting in Mumbai

The United States Cybersecurity and Infrastructure Security Agency (CISA) recently added critical vulnerabilities impacting Array Networks products to its Known Exploited Vulnerabilities (KEV) catalog, warning that threat actors are actively weaponizing these security flaws in the wild. Array Networks appliances—widely deployed for SSL VPN remote access, application delivery controllers (ADC), and secure enterprise connectivity—are foundational infrastructure for corporate enterprises, financial institutions, and government bodies across India.

For IT heads, Chief Information Security Officers (CISOs), and legal counsels across Mumbai, Thane, and the wider Mumbai Metropolitan Region (MMR), this advisory is not just an international alert; it represents an immediate operational risk and a potential trigger for regulatory liability under Indian cyber law.

This article outlines the technical nature of such remote access threats, examines the corporate compliance mandates under CERT-In, analyzes legal remedies under the Information Technology (IT) Act, 2000 alongside the new criminal codes, and provides a clear guide on how affected organizations in Mumbai can initiate formal legal reporting.

1. Understanding the Threat: Array Networks Remote Access Exploits

Array Networks AG and vxAG secure access gateways provide employees and external vendors with remote access to internal corporate networks. Vulnerabilities in these perimeter devices—such as arbitrary file reading, remote code execution (RCE), or path traversal flaws—pose severe enterprise hazards.

How Threat Actors Weaponize Such Flaws:

Perimeter Compromise without Credentials: Attackers can bypass authentication controls, obtaining internal system access without needing valid employee user accounts or multi-factor authentication (MFA).
Credential Dumping and Privilege Escalation: Once inside the gateway, attackers often extract cached configuration files, VPN session keys, and Active Directory credentials.
Lateral Movement and Ransomware Staging: Attackers use the compromised gateway as an operational beachhead, moving laterally across internal subnets, compromising database clusters, exfiltrating proprietary records, and ultimately deploying enterprise-wide ransomware.

When foreign agencies like CISA flag active exploitation, it signals that automated threat scanners are actively querying global IP blocks—including Indian enterprise IP spaces—for unpatched systems.

2. Indian Regulatory and Compliance Obligations

A critical vulnerability actively exploited at the network boundary triggers time-sensitive statutory compliance obligations under Indian law.

A. The CERT-In 6-Hour Mandatory Reporting Window

Under the Directions issued pursuant to Section 70B(6) of the Information Technology Act, 2000 by the Indian Computer Emergency Response Team (CERT-In), all service providers, intermediaries, data centers, body corporates, and government organizations must mandatorily report cybersecurity incidents to CERT-In within six (6) hours of noticing or being brought to notice of the incident.

Qualifying incidents under the CERT-In annexure include:

Unauthorized access to IT systems/data.
Compromise of critical systems or perimeter appliances.
Ransomware or malicious code attacks.
Identity theft, spoofing, and targeted intrusions.

Failing to furnish information or report within the stipulated timeframe attracts penal provisions under Section 70B(7) of the IT Act, which carries imprisonment of up to one year, a fine of up to ₹1,00,000, or both.

B. Compliance Under Sectoral Regulators

For enterprises operating in the financial and commercial heart of Mumbai:

RBI Cyber Security Framework for Banks & NBFCs: Regulated financial institutions must report incidents to the Reserve Bank of India (RBI) within 2 to 6 hours.
SEBI Cyber Security Framework: Stockbrokers, mutual funds, and market intermediaries registered with SEBI must immediately escalate breaches to the regulator's incident desk.

C. Digital Personal Data Protection (DPDP) Act, 2023

If an intrusion into an Array Networks appliance leads to unauthorized access, copying, or exfiltration of personal data, the entity acting as a Data Fiduciary is statutorily obligated to notify both the Data Protection Board of India and each affected individual, exposing the organization to significant financial penalties for failure to implement reasonable security safeguards.

3. Indian Legal Remedies and Penal Framework

When a network is breached through an unpatched or zero-day vulnerability, corporate victims possess both statutory civil remedies and criminal mechanisms to pursue bad actors.

+---------------------------------------------------------------------------------+
|                      LEGAL FRAMEWORK FOR CYBER INTRUSIONS                       |
+---------------------------------------------------------------------------------+
| IT Act, 2000       | • Sec 43: Statutory damages for unauthorized access/download|
|                    | • Sec 66: Hacking & computer-related offenses               |
|                    | • Sec 66C/66D: Identity theft & cheating by impersonation   |
+--------------------+------------------------------------------------------------+
| BNS, 2023          | • Sec 308: Extortion (Ransomware demands)                   |
|                    | • Sec 318: Cheating & fraud                                 |
|                    | • Sec 316: Criminal breach of trust (Insider collusion)     |
+--------------------+------------------------------------------------------------+
| BSA, 2023          | • Sec 61 & 63: Electronic records admissibility & electronic|
|                    |   certificate requirements (replaces Sec 65B Evidence Act)  |
+--------------------+------------------------------------------------------------+

Civil Compensation Under the Information Technology Act, 2000

Section 43 of the IT Act: Anyone who, without permission of the owner or person in charge of a computer system, accesses, downloads, copies, or introduces contaminants into such a system is liable to pay damages by way of compensation to the affected party.
Adjudicating Officer (AO): In Maharashtra, complaints under Section 43 are filed before the State Adjudicating Officer (the Secretary, Information Technology Department, Government of Maharashtra), offering a quasi-judicial forum for corporate victims to seek financial compensation without relying solely on civil courts.

Criminal Prosecution Under IT Act & Bharatiya Nyaya Sanhita (BNS), 2023

Section 66 of the IT Act: Criminalizes any act referred to in Section 43 done dishonestly or fraudulently, punishable with imprisonment up to three years or a fine up to ₹5,00,000.
Section 308 of BNS, 2023 (Extortion): If the perimeter breach culminates in a ransomware payout demand, charges of extortion under the BNS apply.
Section 318 of BNS, 2023 (Cheating): Applies when attackers use stolen VPN credentials or forged machine identities to fraudulently extract funds or confidential assets.
Section 316 of BNS, 2023 (Criminal Breach of Trust): Attracts liability if an external maintenance vendor or rogue internal employee intentionally neglected security patches or shared administrative credentials with malicious actors.

4. Evidentiary Standards Under Bharatiya Sakshya Adhiniyam (BSA), 2023

With the replacement of the Indian Evidence Act, 1872 by the Bharatiya Sakshya Adhiniyam, 2023 (BSA), organizations handling digital incident investigations must adapt their digital forensics handling.

Section 61 and Section 63 of the BSA, 2023: Set forth the admissibility conditions for electronic records (replacing the erstwhile Section 65B regime).
For server logs, VPN connection histories, firewall telemetry, and forensic disk images to hold evidentiary weight before the police and courts, they must be preserved in a chain of custody and certified under Section 63 of the BSA by the person in lawful control of the device or an authorized expert.

Actionable Rule: Never wipe, reinstall, or reboot an appliance immediately after detecting an intrusion without first taking an image and forensically preserving volatile memory and system logs.

5. How Corporate Victims in Mumbai, Thane, and Mira Road Can Report

When an intrusion is confirmed, organizations based in the Mumbai Metropolitan Region must act through formal legal and police channels alongside their technical triage.

Step 1: Immediate Triage and Internal Evidence Locking

Isolate the affected Array Networks appliance from the internal VLAN to prevent lateral migration.
Capture memory dumps, active session tables, and system logs.
Notify your legal team to supervise digital chain-of-custody documentation under BSA, 2023.

Step 2: Formal Reporting to CERT-In

Transmit the incident report to incident@cert-in.org.in using the prescribed incident reporting format within the statutory 6-hour deadline.

Step 3: Registering a Complaint with Maharashtra Cyber Police

Depending on the location of your corporate office or server infrastructure:

Mumbai Police Cyber Cell:
- Bandra-Kurla Complex (BKC) Cyber Police Station: Primary nodal station for major corporate cybercrimes, ransomware attacks, and high-value data breaches in Mumbai.
- Regional Cyber Police Stations: South Region (Worli), East Region (Chembur), West Region (Bandra), Central Region (Nagpada), and North Region (Kandivali).
Thane Commissionerate Cyber Crime Cell: Located at the Police Commissionerate, Thane West, handling corporate incidents within Thane municipal limits.
Mira-Bhayandar Vasai-Virar (MBVV) Cyber Crime Cell: Serves businesses and infrastructure located across Mira Road, Bhayandar, Vasai, and Virar.

Step 4: Online Filing via the National Portal

Lodge an initial online complaint at cybercrime.gov.in or call the National Cyber Helpline at 1930 to secure an acknowledgement token, which can then be submitted to the local Cyber Police Station to convert the complaint into a formal First Information Report (FIR) under Section 173 of the Bharatiya Nagarik Suraksha Sanhita (BNSS), 2023.

Frequently Asked Questions (FAQs)

1. Are we legally required to report a vulnerability scan or failed breach attempt to CERT-In?

Routine automated port scans or blocked probing attempts do not necessarily require formal reporting unless they result in system compromise, service outage, or unauthorized data access. However, if an exploit against an Array Networks appliance was successful—even if data exfiltration was intercepted midway—it constitutes unauthorized access and falls within the mandatory 6-hour reporting mandate.

2. Can our company face civil liability if customer data is compromised through an unpatched flaw?

Yes. Under Section 43A of the IT Act (and corresponding rules regarding reasonable security practices) as well as the provisions of the DPDP Act, 2023, entities handling sensitive commercial or personal data that fail to maintain adequate security controls (such as neglecting publicized critical security patches) can be sued for damages or penalized by regulatory boards.

3. What constitutes an electronic certificate under the new Bharatiya Sakshya Adhiniyam, 2023?

Under Section 63 of the BSA, 2023, electronic evidence must be accompanied by an electronic certificate signed by an authorized manager or technical expert. This certificate must confirm the integrity of the device, verify that the computer system was operating properly at the time the records were produced, and detail the hash values and custody steps taken to ensure that logs were not altered.

4. What is the difference between filing an application before the IT Adjudicating Officer and an FIR with the Police?

An FIR registered under the BNSS, 2023 focuses on the criminal prosecution of the threat actors (resulting in arrests, asset seizures, and imprisonment under the IT Act and BNS). An application before the State IT Adjudicating Officer is a quasi-judicial civil proceeding aimed at recovering financial damages and compensation from perpetrators, negligent vendors, or responsible third parties.

Navigating Cyber Compliance with APS Law

Managing an active cyber incident requires a synchronized legal, regulatory, and forensic response. Deficiencies in log preservation or delayed statutory notices can transform an operational network compromise into regulatory penalties and civil exposure.

APS Law assists corporate clients, mid-market businesses, and startups across Mumbai, Thane, and Mira Road with cyber incident response, CERT-In compliance filings, forensic chain-of-custody advisory under the BSA, and cyber litigation before the Adjudicating Officer and Cyber Police.

If your organization requires assistance with cybersecurity compliance, regulatory reporting, or legal representation in cyber offenses, contact APS Law to schedule an advisory consultation.