|CERT-In Vulnerability Note
Remote Code Execution Vulnerability in Citrix Products
Original Issue Date:January 06, 2020
Severity Rating: HIGH
- Citrix Application Delivery Controller(ADC) and Citrix Gateway version 13.0
- Citrix Application Delivery Controller(ADC) and NetScaler Gateway version 12.1
- Citrix Application Delivery Controller(ADC) and NetScaler Gateway version 12.0
- Citrix Application Delivery Controller(ADC) and NetScaler Gateway version 11.1
- Citrix NetScaler Application Delivery Controller(ADC) and NetScaler Gateway version 10.5
A vulnerability has been reported in Citrix Application Delivery Controller and Citrix Gateway which could allow a remote attacker to execute arbitrary code on a targeted system.
The vulnerability exists in Citrix ADC and Citrix Gateway due to improper handling of HTTP based VPN requests. A remote attacker may exploit this vulnerability by sending a crafted web request to the affected systems.
Successful exploitation of the vulnerability could allow the attacker to execute arbitrary code on the targeted system.
Apply appropriate mitigation steps as mentioned in the following link:
The information provided herein is on "as is" basis, without warranty of any kind.
Email: firstname.lastname@example.org Phone: +91-11-24368572
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
6, CGO Complex, Lodhi Road,
New Delhi - 110 003