CISA KEV · Known exploitedHigh

CVE-2023-6549

Citrix NetScaler ADC and NetScaler Gateway

Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial of Service and Out-Of-Bounds Memory Read

CVSS: 7.5
EPSS: 57.6%
CISA KEV: Listed
Published: 2024.01.18

PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV

Exploit probability57.6%

Technical severityCVSS 7.5

Vulnerability overview

Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial of Service and Out-Of-Bounds Memory Read

Affected product and versions

Product: Citrix NetScaler ADC and NetScaler Gateway
Affected versions: 14.1, 13.1, 13.0, 13.1-FIPS, 12.1-FIPS, 12.1-NDcPP, >= 12.1 < 12.1-55.302, >= 13.0 < 13.0-92.21, >= 13.1 < 13.1-37.176, >= 13.1 < 13.1-51.15, >= 14.1 < 14.1-12.35
Fixed versions: 12.1-55.302, 13.0-92.21, 13.1-37.176, 13.1-51.15, 14.1-12.35

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Due date: 2024.02.07

1
Identify
Confirm that Citrix NetScaler ADC and NetScaler Gateway and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-119
KEV added: 2024.01.17
Ransomware use: 미확인