CISA KEV · Known exploitedMedium

CVE-2020-8195

Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance

Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.

CVSS: 6.5
EPSS: 33.3%
CISA KEV: Listed
Published: 2020.07.11

PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV

Exploit probability33.3%

Technical severityCVSS 6.5

Vulnerability overview

Affected product and versions

Product: Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
Affected versions: Citrix ADC and Citrix Gateway 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP 11.1.1a, 11.0.3d and 10.2.7, >= 10.5 < 10.5-70.18, >= 11.1 < 11.1-64.14, >= 12.0 < 12.0-63.21, >= 12.1 < 12.1-57.18, >= 13.0 < 13.0-58.30, >= 10.2 < 10.2.7, >= 11.0 < 11.0.3d, >= 11.1 < 11.1.1a, < 1.0.0.137
Fixed versions: 10.5-70.18, 11.1-64.14, 12.0-63.21, 12.1-57.18, 13.0-58.30, 10.2.7, 11.0.3d, 11.1.1a, 1.0.0.137

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

CISA required action

Apply updates per vendor instructions.

Due date: 2022.05.03

1
Identify
Confirm that Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE: CWE-20, CWE-22
KEV added: 2021.11.03
Ransomware use: 미확인