Active Exploitation of Zero-Day Vulnerability in Citrix’s Netscaler ADC and Gateway Products

Citrix has released security updates addressing a zero-day vulnerability (CVE-2023-6549) in their Netscaler ADC and Gateway products. The vulnerability is reportedly being actively exploited.

Successful exploitation of this vulnerability could allow an attacker to conduct denial-of-service (DoS) attacks when the appliances are configured as a gateway or an Authentication, Authorisation and Accounting (AAA) virtual server.

The vulnerability affects the following product versions:

• NetScaler ADC and NetScaler Gateway versions 14.1 before 14.1-12.35

• NetScaler ADC and NetScaler Gateway versions 13.1 before 13.1-51.15

• NetScaler ADC and NetScaler Gateway versions 13.0 before 13.0-92.21

• NetScaler ADC and NetScaler Gateway version 12.1 (End Of Life)

• NetScaler ADC 12.1-FIPS versions before 12.1-55.302

• NetScaler ADC 13.1-FIPS versions before 13.1-37.176

• NetScaler ADC 12.1-NDcPP versions before 12.1-55.302

Users and administrators of the affected products, especially the End-Of-Life products are advised to update to the latest versions or a supported version immediately.

More information is available here:

https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549

https://www.bleepingcomputer.com/news/security/citrix-warns-of-new-netscaler-zero-days-exploited-in-attacks/amp/

https://securityonline.info/cve-2023-6548-6549-two-new-citrix-netscaler-zero-days-exploited-in-attacks/?expand_article=1