CVE-2023-6548

MEDIUMCISA KEV

5.5

Descricao

Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.

Detalhes CVE

Pontuacao CVSS v3.15.5

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Vetor de ataqueADJACENT_NETWORK

ComplexidadeLOW

Privilegios necessariosLOW

Interacao do usuarioNONE

Publicado1/17/2024

Ultima modificacao10/24/2025

Fontekev

Avistamentos honeypot0

CISA KEV

FornecedorCitrix

ProdutoNetScaler ADC and NetScaler Gateway

Nome da vulnerabilidadeCitrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability

Data inclusao KEV2024-01-17

Prazo de remediacao2024-01-24

Uso em ransomwareUnknown

Produtos afetados

citrix:netscaler_application_delivery_controllercitrix:netscaler_gateway

Fraquezas (CWE)

CWE-94CWE-94

Referencias

https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549(secure@citrix.com)

https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-6548(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.