CVE-2010-4566

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 27.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2011-01-14 · updated 2026-06-16

Description

The web authentication form in the NT4 authentication component in Citrix Access Gateway Enterprise Edition 9.2-49.8 and earlier, and the NTLM authentication component in Access Gateway Standard and Advanced Editions before Access Gateway 5.0, allows attackers to execute arbitrary commands via shell metacharacters in the password field.

Affected products

Citrix Access Gateway: through 9.2-49.8; .8.0-m50.3, 8.0-m48.7, 8.0-m49.2, 8.0-m59.1, 4.5-hf1; 8.1-69.4, 9.0.71.3, 9.1-104.5, 4.5, 4.5.5, 4.5.6 (+4) (and their updates)

References

http://securityreason.com/securityalert/8119
http://support.citrix.com/article/CTX127613
http://www.exploit-db.com/exploits/16916
http://www.osvdb.org/70099
http://www.securitytracker.com/id?1024893
http://www.vsecurity.com/resources/advisory/20101221-1
http://securityreason.com/securityalert/8119
http://support.citrix.com/article/CTX127613
http://www.exploit-db.com/exploits/16916
http://www.osvdb.org/70099
http://www.securitytracker.com/id?1024893
http://www.vsecurity.com/resources/advisory/20101221-1

Get alerted when CVE-2010-4566 or the next vulnerability affects your stack