Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Jan 17, 2024 · Catalog

   Detected

   Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.

2. Jan 17, 2024 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

3. Jan 24, 2024 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

4. Jun 16, 2026 · Catalog

   Updated

   Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.

Affected

• cpe citrix/netscaler application delivery controllerversion unspecified
• cpe citrix/netscaler gatewayversion unspecified
• vendor Citrix NetScaler ADC and NetScaler Gatewayversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2023-6548

  Citrix NetScaler ADC and NetScaler Gateway contain a code injection vulnerability that allows for authenticated remote code execution on the management interface with access to NSIP, CLIP, or SNIP.

  cisa.gov
• CVE.orgVulnerability recordCVE-2023-6548

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2023-6548

  30-day exploitation probability 3.2%

  first.org
• NIST NVDVulnerability recordCVE-2023-6548

  Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.

  nvd.nist.gov

References

• CISA note · nvd.nist.gov
• CISA note · support.citrix.com
• US Government Resource · cisa.gov