Actively exploited · Published Jan 17, 2024 · Assigned by Citrix
CVE-2023-6549
High 8.2 Exploited
In plain English
A high-severity memory corruption in NetScaler ADC from Cloud Software Group. Attackers are actively exploiting it in the wild (listed by CISA on January 17, 2024). The chance it is exploited in the next 30 days is estimated at 57.6% (higher than 99.1% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Feb 7, 2024.
Official description
Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial of Service and Out-Of-Bounds Memory Read
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cloud Software Group | NetScaler ADC | 14.1 – before 12.3513.1 – before 51.1513.0 – before 92.2113.1-FIPS – before 37.17612.1-FIPS – before 55.30212.1-NDcPP – before 55.302 |
Weakness: CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H