CVE-2017-17549

Severity: medium (CVSS 5.9 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-12-13 · updated 2026-06-17
Weakness: CWE-200

Description

Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.5 before build 67.13, 11.0 before build 71.22, 11.1 before build 56.19, and 12.0 before build 53.22 allow remote attackers to obtain sensitive information from the backend client TLS handshake by leveraging use of TLS with Client Certificates and a Diffie-Hellman Ephemeral (DHE) key exchange.

Affected products

Citrix Application Delivery Controller Firmware: 10.5, 11.0, 11.1, 12.0 (and their updates)
Citrix Netscaler Gateway Firmware: 10.5, 11.0, 11.1, 12.0 (and their updates)

References

http://www.securityfocus.com/bid/102177
http://www.securitytracker.com/id/1040011
https://support.citrix.com/article/ctx230612
http://www.securityfocus.com/bid/102177
http://www.securitytracker.com/id/1040011
https://support.citrix.com/article/ctx230612

Get alerted when CVE-2017-17549 or the next vulnerability affects your stack