Description
Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.
Metrics
CVSS 3.1 8.8/10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Cloud Software Group | NetScaler ADC | >= 14.1, < 12.35; >= 13.1, < 51.15; >= 13.0, < 92.21; >= 13.1-FIPS, < 37.176; >= 12.1-FIPS, < 55.302; >= 12.1-NDcPP, < 55.302 |
| Cloud Software Group | NetScaler Gateway | >= 14.1, < 12.35; >= 13.1, < 51.15; >= 13.0, < 92.21 |
| citrix | netscaler_application_delivery_controller | >= 14.1, < 14.1-12.35 |
| citrix | netscaler_application_delivery_controller | >= 13.1, < 13.1-51.15 |
| citrix | netscaler_application_delivery_controller | >= 13.0, < 13.0-92.21 |
| citrix | netscaler_application_delivery_controller | >= 13.1, < 13.1-37.176 |
| citrix | netscaler_application_delivery_controller | >= 12.1, < 12.1-55.302 |
| citrix | netscaler_application_delivery_controller | >= 12.1, < 12.1-55.302 |
| citrix | netscaler_gateway | >= 14.1, < 14.1-12.35 |
| citrix | netscaler_gateway | >= 13.1, < 13.1-51.15 |
| citrix | netscaler_gateway | >= 13.0, < 13.0-92.21 |
References
- https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549Vendor Advisory
- https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-6548US Government Resource
Timeline
- Published
- Jan 17, 2024
- Last modified
- Jun 17, 2026
- Added to CISA KEV
- Jan 17, 2024
- NVD status
- Analyzed