CVE-2023-6548: Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
Vulnerability summary
CVE-2023-6548 is a high (CVSS 8.8) Code Injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway. It is known to be exploited: CISA lists it, first on 17-01-2024. EPSS estimates a 3.19% chance of exploitation in the next 30 days, higher than 87.9% of scored vulnerabilities.
Timeline
- 17-01-2024PublishedVulnerability first disclosed.
- 17-01-2024Added to CISA KEVCitrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
- 24-01-2024CISA remediation dueApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- 21-10-2025Last modifiedVulnerability information updated.
Description
Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA5.5MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LDiffers
EPSS trend
Probability
3.19%
Chance of exploitation in the next 30 days
Percentile
88%
Versus all other CVEs
30-day change
0.00 pp
From 3.19% on 19-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 17-01-2024
- Federal due date
- 24-01-2024
CISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. support.citrix.com/article/… nvd.nist.gov/vuln/detail/CVE-2023-6548
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Citrix2 products
- netscaler_application_delivery_controller≥ 12.1, < 12.1-55.302 | ≥ 13.0, < 13.0-92.21 | ≥ 13.1, < 13.1-37.176 | ≥ 13.1, < 13.1-51.15 | ≥ 14.1, < 14.1-12.35
- netscaler_gateway≥ 13.0, < 13.0-92.21 | ≥ 13.1, < 13.1-51.15 | ≥ 14.1, < 14.1-12.35
Cloud software group2 products
- netscaler adc≥ 14.1, < 12.35 | ≥ 13.1, < 51.15 | ≥ 13.0, < 92.21 | ≥ 13.1-FIPS, < 37.176 | ≥ 12.1-FIPS, < 55.302 | ≥ 12.1-NDcPP, < 55.302
- netscaler gateway≥ 14.1, < 12.35 | ≥ 13.1, < 51.15 | ≥ 13.0, < 92.21
2 vendors · 4 products
References
2 links- support.citrix.com/article/…Vendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-6548Government ResourceUS Government Resource