medium5.5Known exploited
CVE-2023-6548
Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2024-01-17. Federal due date: 2024-01-24.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Impact
Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Citrix | Netscaler Application Delivery Controller | from 12.1 before 12.1-55.302 from 13.0 before 13.0-92.21 from 13.1 before 13.1-37.176 from 13.1 before 13.1-51.15 from 14.1 before 14.1-12.35 |
| Citrix | Netscaler Gateway | from 13.0 before 13.0-92.21 from 13.1 before 13.1-51.15 from 14.1 before 14.1-12.35 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549
- https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-6548