CISA confirmed this vulnerability is used in real attacks on 17.01.2024. Remediation deadline for US federal agencies: 07.02.2024.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549; https://nvd.nist.gov/vuln/detail/CVE-2023-6549
Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial of Service and Out-Of-Bounds Memory Read
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
| Vendor | Product | Versions | |
|---|---|---|---|
| citrix | netscaler application delivery controller | 12.1 – < 12.1-55.302 | |
| citrix | netscaler gateway | 13.0 – < 13.0-92.21 | |
| Cloud Software Group | NetScaler ADC | 14.1 – < 12.35, 13.1 – < 51.15, 13.0 – < 92.21, 13.1-FIPS – < 37.176, 12.1-FIPS – < 55.302, 12.1-NDcPP – < 55.302 |
cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:* ≥ 12.1 < 12.1-55.302cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:* ≥ 12.1 < 12.1-55.302cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:* ≥ 13.0 < 13.0-92.21cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:* ≥ 13.1 < 13.1-37.176cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:* ≥ 13.1 < 13.1-51.15cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:* ≥ 14.1 < 14.1-12.35cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:* ≥ 13.0 < 13.0-92.21cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:* ≥ 13.1 < 13.1-51.15cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:* ≥ 14.1 < 14.1-12.35Our free, open-source honeypot sensor waits on ports your server does not use and reports the scanners and attackers that connect to a shared blocklist.