critical9.8Known exploitedPublic exploit code
CVE-2019-12989
Citrix SD-WAN and NetScaler SQL Injection Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-03-25. Federal due date: 2022-04-15.
Apply updates per vendor instructions.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Citrix SD-WAN Appliance 10.2.2 - Authentication Bypass / Remote Command Execution2019-07-12 · webapps · cgi · Verified
Impact
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Citrix | Netscaler Sd-Wan | from 10.0.0 before 10.0.8 |
| Citrix | Sd-Wan | from 10.2.0 before 10.2.3 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://packetstormsecurity.com/files/153638/Citrix-SD-WAN-Appliance-10.2.2-Authentication-Bypass-Remote-Command-Execution.html
- http://www.securityfocus.com/bid/109133
- https://support.citrix.com/article/CTX251987
- https://www.tenable.com/security/research/tra-2019-32
- http://packetstormsecurity.com/files/153638/Citrix-SD-WAN-Appliance-10.2.2-Authentication-Bypass-Remote-Command-Execution.html
- http://www.securityfocus.com/bid/109133
- https://support.citrix.com/article/CTX251987
- https://www.tenable.com/security/research/tra-2019-32
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-12989