CVE-2023-6549: Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability

Vulnerability summary

CVE-2023-6549 is a high (CVSS 8.2) vulnerability in Citrix NetScaler ADC and NetScaler Gateway. It is known to be exploited: CISA lists it, first on 17-01-2024. EPSS estimates a 57.63% chance of exploitation in the next 30 days, higher than 99% of scored vulnerabilities.

Timeline

1. 17-01-2024
   PublishedVulnerability first disclosed.
2. 17-01-2024
   Added to CISA KEVCitrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability
3. 07-02-2024
   CISA remediation dueApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial of Service and Out-Of-Bounds Memory Read

• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.