CVE-2023-6548: Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2024-01-17
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-17 · updated 2026-06-17
Weakness: CWE-94

Description

Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.

Summary

CVE-2023-6548 is a code injection flaw in Citrix NetScaler ADC and NetScaler Gateway that lets a low-privileged authenticated attacker with access to the NSIP, CLIP or SNIP management interface achieve remote code execution on the Management Interface. Rated CVSS 8.8 (high), it is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation. Affected are NetScaler ADC (fixed in 12.1-55.302, 13.0-92.21, 13.1-37.176, 13.1-51.15) and NetScaler Gateway (fixed in 13.0-92.21, 13.1-51.15, 14.1-12.35). Apply the vendor's fixed versions or mitigations promptly, or discontinue use if mitigations are unavailable, and restrict management interface access.

CVE-2023-6548 هو ثغرة حقن تعليمات برمجية في Citrix NetScaler ADC وNetScaler Gateway تتيح لمهاجم مصادَق عليه بصلاحيات منخفضة ولديه وصول إلى واجهة الإدارة NSIP أو CLIP أو SNIP تنفيذ تعليمات برمجية عن بُعد على واجهة الإدارة. حصلت الثغرة على تقييم CVSS قدره 8.8 (مرتفع)، وهي مدرجة في كتالوج CISA للثغرات المعروفة باستغلالها مع استغلال نشط. تشمل المنتجات المتأثرة NetScaler ADC (تم إصلاحها في 12.1-55.302 و13.0-92.21 و13.1-37.176 و13.1-51.15) وNetScaler Gateway (تم إصلاحها في 13.0-92.21 و13.1-51.15 و14.1-12.35). يجب تطبيق الإصدارات المُصلحة أو التخفيفات وفق تعليمات المورّد فورًا، أو التوقف عن استخدام المنتج إذا لم تتوفر التخفيفات، مع تقييد الوصول إلى واجهة الإدارة.

Affected products

Citrix NetScaler ADC: from 13.0 before 13.0-92.21; from 13.1 before 13.1-51.15; from 14.1 before 14.1-12.35 — fixed in 13.0-92.21, 13.1-51.15, 14.1-12.35
Citrix Netscaler Application Delivery Controller Fips: from 12.1 before 12.1-55.302; from 13.1 before 13.1-37.176 — fixed in 12.1-55.302, 13.1-37.176
Citrix Netscaler Application Delivery Controller Ndcpp: from 12.1 before 12.1-55.302 — fixed in 12.1-55.302
Citrix NetScaler Gateway: from 13.0 before 13.0-92.21; from 13.1 before 13.1-51.15; from 14.1 before 14.1-12.35 — fixed in 13.0-92.21, 13.1-51.15, 14.1-12.35
Citrix NetScaler ADC: from 14.1 before 14.1-12.35 — fixed in 14.1-12.35
Citrix NetScaler Gateway: from 14.1 before 14.1-12.35 — fixed in 14.1-12.35
Citrix NetScaler ADC: from 14.1 before 12.35; from 13.1 before 51.15; from 13.0 before 92.21; from 13.1-FIPS before 37.176; from 12.1-FIPS before 55.302; from 12.1-NDcPP before 55.302 — fixed in 12.35, 51.15, 92.21, 37.176, 55.302
Citrix NetScaler Gateway: from 14.1 before 12.35; from 13.1 before 51.15; from 13.0 before 92.21 — fixed in 12.35, 51.15, 92.21

How to fix

Upgrade to a fixed version: Citrix NetScaler ADC 13.0-92.21, 13.1-51.15, 14.1-12.35; Citrix Netscaler Application Delivery Controller Fips 12.1-55.302, 13.1-37.176; Citrix Netscaler Application Delivery Controller Ndcpp 12.1-55.302; Citrix NetScaler Gateway 13.0-92.21, 13.1-51.15, 14.1-12.35; Citrix NetScaler ADC 14.1-12.35; Citrix NetScaler Gateway 14.1-12.35; Citrix NetScaler ADC 12.35, 51.15, 92.21, 37.176; Citrix NetScaler Gateway 12.35, 51.15, 92.21. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-6548 or the next vulnerability affects your stack