What’s Vulnerable › Vulnerabilities

CVE-2024-2049: Server-Side Request Forgery (SSRF)

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-03-12 · updated 2026-06-17
• Weakness: CWE-918

Description

Server-Side Request Forgery (SSRF) in Citrix SD-WAN Standard/Premium Editions on or after 11.4.0 and before 11.4.4.46 allows an attacker to disclose limited information from the appliance via Access to management IP.

Affected products

• Citrix Sd-Wan 1000 Firmware: from 11.4.0 before 11.4.4.46 — fixed in 11.4.4.46
• Citrix Sd-Wan 1100 Firmware: from 11.4.0 before 11.4.4.46 — fixed in 11.4.4.46
• Citrix Sd-Wan 110 Firmware: from 11.4.0 before 11.4.4.46 — fixed in 11.4.4.46
• Citrix Sd-Wan 2000 Firmware: from 11.4.0 before 11.4.4.46 — fixed in 11.4.4.46
• Citrix Sd-Wan 2100 Firmware: from 11.4.0 before 11.4.4.46 — fixed in 11.4.4.46
• Citrix Sd-Wan 210 Firmware: from 11.4.0 before 11.4.4.46 — fixed in 11.4.4.46
• Citrix Sd-Wan 4000 Firmware: from 11.4.0 before 11.4.4.46 — fixed in 11.4.4.46
• Citrix Sd-Wan 400 Firmware: from 11.4.0 before 11.4.4.46 — fixed in 11.4.4.46
• Citrix Sd-Wan 4100 Firmware: from 11.4.0 before 11.4.4.46 — fixed in 11.4.4.46
• Citrix Sd-Wan 410 Firmware: from 11.4.0 before 11.4.4.46 — fixed in 11.4.4.46
• Citrix Sd-Wan 5100 Firmware: from 11.4.0 before 11.4.4.46 — fixed in 11.4.4.46
• Citrix Sd-Wan 6100 Firmware: from 11.4.0 before 11.4.4.46 — fixed in 11.4.4.46
• Citrix Sd Wan Premium Edition: from 11.4 before 11.4.4.46 — fixed in 11.4.4.46
• Citrix Sd Wan Standard Edition: from 11.4 before 11.4.4.46 — fixed in 11.4.4.46
• Citrix SD-WAN Standard/Premium Editions: from 11.4 before 11.4.4.46 — fixed in 11.4.4.46

How to fix

Upgrade to a fixed version: Citrix Sd-Wan 1000 Firmware 11.4.4.46; Citrix Sd-Wan 1100 Firmware 11.4.4.46; Citrix Sd-Wan 110 Firmware 11.4.4.46; Citrix Sd-Wan 2000 Firmware 11.4.4.46; Citrix Sd-Wan 2100 Firmware 11.4.4.46; Citrix Sd-Wan 210 Firmware 11.4.4.46; Citrix Sd-Wan 4000 Firmware 11.4.4.46; Citrix Sd-Wan 400 Firmware 11.4.4.46; Citrix Sd-Wan 4100 Firmware 11.4.4.46; Citrix Sd-Wan 410 Firmware 11.4.4.46; Citrix Sd-Wan 5100 Firmware 11.4.4.46; Citrix Sd-Wan 6100 Firmware 11.4.4.46. Check the vendor advisory for mitigations.

References

• https://support.citrix.com/article/CTX617071/citrix-sdwan-security-bulletin-for-cve20242049
• https://support.citrix.com/external/article?articleUrl=CTX617071-citrix-sdwan-security-bulletin-for-cve20242049&language=en_US
• https://support.citrix.com/article/CTX617071/citrix-sdwan-security-bulletin-for-cve20242049

Get alerted when CVE-2024-2049 or the next vulnerability affects your stack