IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
5.5Mittel KEV

CVE-2023-6548Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability

Cloud Software Group NetScaler ADC; Cloud Software Group NetScaler Gateway; citrix netscaler_application_delivery_controller; citrix netscaler_gateway Veröffentlicht: (vor 2 Jahren)

Bekannt ausgenutzt — Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability

CISA hat am 17.01.2024 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 24.01.2024.

Erforderliche Maßnahme: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549; https://nvd.nist.gov/vuln/detail/CVE-2023-6548

Beschreibung

Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.

Schwachstellentyp (CWE): CWE-94

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
citrix netscaler_application_delivery_controller 14.1 – < 14.1-12.35
citrix netscaler_gateway 14.1 – < 14.1-12.35
Cloud Software Group NetScaler ADC 14.1 – < 12.35, 13.1 – < 51.15, 13.0 – < 92.21, 13.1-FIPS – < 37.176, 12.1-FIPS – < 55.302, 12.1-NDcPP – < 55.302
Cloud Software Group NetScaler Gateway 14.1 – < 12.35, 13.1 – < 51.15, 13.0 – < 92.21

Referenzen und Patches

CPE-Treffer (NVD) (9)
  • cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:* ≥ 12.1 < 12.1-55.302
  • cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:* ≥ 12.1 < 12.1-55.302
  • cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:* ≥ 13.0 < 13.0-92.21
  • cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:* ≥ 13.1 < 13.1-37.176
  • cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:* ≥ 13.1 < 13.1-51.15
  • cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:* ≥ 14.1 < 14.1-12.35
  • cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:* ≥ 13.0 < 13.0-92.21
  • cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:* ≥ 13.1 < 13.1-51.15
  • cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:* ≥ 14.1 < 14.1-12.35

Neue CVEs im selben Produkt — Citrix NetScaler ADC / Gateway

8.8Hoch
CVE-2026-88778

TCP Initial Sequence Number (ISN) prediction

Citrix NetScaler ADC; Citrix NetScaler Gateway

Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1…