CISA KEV · Known exploitedMedium

CVE-2020-8196

Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance

Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.

CVSS: 4.3
EPSS: 26.3%
CISA KEV: Listed
Published: 2020.07.11

PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV

Exploit probability26.3%

Technical severityCVSS 4.3

Vulnerability overview

Affected product and versions

Product: Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
Affected versions: Citrix ADC and Citrix Gateway 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP 11.1.1a, 11.0.3d and 10.2.7, >= 10.5 < 10.5-70.18, >= 11.1 < 11.1-64.14, >= 12.0 < 12.0-63.21, >= 12.1 < 12.1-57.18, >= 13.0 < 13.0-58.30, >= 10.2 < 10.2.7, >= 11.0 < 11.0.3d, >= 11.1 < 11.1.1a
Fixed versions: 10.5-70.18, 11.1-64.14, 12.0-63.21, 12.1-57.18, 13.0-58.30, 10.2.7, 11.0.3d, 11.1.1a

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

CISA required action

Apply updates per vendor instructions.

Due date: 2022.05.03

1
Identify
Confirm that Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE: CWE-284, CWE-287
KEV added: 2021.11.03
Ransomware use: 미확인