Actively exploited · Published Jul 20, 2017 · Assigned by mitre

CVE-2017-6316

Critical 9.8 Exploited

In plain English

A critical-severity security flaw in NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server from Citrix. Attackers are actively exploiting it in the wild (listed by CISA on March 25, 2022). The chance it is exploited in the next 30 days is estimated at 73.0% (higher than 99.5% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)73.0%top 0.5% of all CVEs

Exploited in the wildYesCISA KEV since Mar 25, 2022

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Apr 15, 2022.

Official description

Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as root via a CGISESSID cookie. On CloudBridge (the former name of NetScaler SD-WAN) devices, the cookie name was CAKEPHP rather than CGISESSID.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

1039019 vdb-entry, x_refsource_SECTRACK
https://support.citrix.com/article/CTX225990 x_refsource_CONFIRM
42345 exploit, x_refsource_EXPLOIT-DB
99943 vdb-entry, x_refsource_BID
42346 exploit, x_refsource_EXPLOIT-DB
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6316 government-resource