CISA confirmed this vulnerability is used in real attacks on 17.01.2024. Remediation deadline for US federal agencies: 24.01.2024.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549; https://nvd.nist.gov/vuln/detail/CVE-2023-6548
Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
| Vendor | Product | Versions | |
|---|---|---|---|
| citrix | netscaler_application_delivery_controller | 14.1 – < 14.1-12.35 | |
| citrix | netscaler_gateway | 14.1 – < 14.1-12.35 | |
| Cloud Software Group | NetScaler ADC | 14.1 – < 12.35, 13.1 – < 51.15, 13.0 – < 92.21, 13.1-FIPS – < 37.176, 12.1-FIPS – < 55.302, 12.1-NDcPP – < 55.302 | |
| Cloud Software Group | NetScaler Gateway | 14.1 – < 12.35, 13.1 – < 51.15, 13.0 – < 92.21 |
cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:* ≥ 12.1 < 12.1-55.302cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:* ≥ 12.1 < 12.1-55.302cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:* ≥ 13.0 < 13.0-92.21cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:* ≥ 13.1 < 13.1-37.176cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:* ≥ 13.1 < 13.1-51.15cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:* ≥ 14.1 < 14.1-12.35cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:* ≥ 13.0 < 13.0-92.21cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:* ≥ 13.1 < 13.1-51.15cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:* ≥ 14.1 < 14.1-12.35Our free, open-source honeypot sensor waits on ports your server does not use and reports the scanners and attackers that connect to a shared blocklist.