CVE-2019-12991
Citrix SD-WAN and NetScaler Command Injection Vulnerability
Description
CVE-2019-12991 is an authenticated OS command injection vulnerability in Citrix SD-WAN and NetScaler SD-WAN appliances. An authenticated attacker can exploit this flaw to inject and execute arbitrary operating system commands on the underlying system with elevated privileges. While authentication is required, the vulnerability enables complete system compromise once initial access is obtained. It was added to the CISA Known Exploited Vulnerabilities catalog on March 25, 2022, and with an EPSS score of 97.3% (99.9th percentile), exploitation is near-certain.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| citrix | netscaler sd-wan | >= 10.0.0, < 10.0.8 |
| citrix | sd-wan | >= 10.2.0, < 10.2.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/153638/Citrix-SD-WAN-Appliance-10.2.2-Authentication-Bypass-Remote-Command-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/109133(Broken Link, Third Party Advisory, VDB Entry)
- https://support.citrix.com/article/CTX251987(Vendor Advisory)
- https://www.tenable.com/security/research/tra-2019-32(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-12991(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
CVE-2019-12991 is classified under CWE-78, which describes vulnerabilities where applications pass user-controlled input to operating system commands without adequate sanitization. The Citrix SD-WAN management interface fails to properly neutralize special characters in user input, enabling authenticated attackers to inject arbitrary commands into system-level operations.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command
Impact Analysis
CVE-2019-12991 allows authenticated attackers to execute arbitrary OS commands on Citrix SD-WAN and NetScaler SD-WAN appliances. Since SD-WAN appliances serve as critical network infrastructure components managing wide-area network traffic, compromise can have cascading effects across the entire organization's network. An attacker can intercept, redirect, or modify network traffic flowing through the SD-WAN fabric, access sensitive network configuration data and routing information, disable or degrade WAN connectivity affecting business operations, and use the compromised appliance as a pivot point for lateral movement. The EPSS score of 97.3% confirms near-certain exploitation for exposed instances.
Exploit Maturity
CVE-2019-12991 has been confirmed as actively exploited in the wild by CISA. While authentication is required, the availability of public exploit information and the high-value nature of SD-WAN infrastructure make this vulnerability an attractive target. Credential stuffing, phishing, or exploitation of companion vulnerabilities (such as CVE-2019-12989 for SQL injection) can provide the initial authentication needed. With an EPSS score of 97.3%, exploitation is near-certain for exposed Citrix SD-WAN appliances.
Remediation
- Apply Citrix security patches: Install the latest firmware updates from Citrix that address CVE-2019-12991, following the vendor's security bulletin.
- Restrict management interface access: Limit access to the SD-WAN management interface to trusted administrator workstations only, using network segmentation and firewall rules.
- Enforce strong authentication: Implement multi-factor authentication for all management access and enforce strong password policies to reduce the risk of credential compromise.
- Audit administrative accounts: Review all administrator accounts, remove unused accounts, and ensure the principle of least privilege is applied.
- Monitor management interface activity: Enable comprehensive logging and monitoring for all management interface access, with alerts for unusual commands or access patterns.
Technical Details
CVE-2019-12991 is an OS command injection vulnerability in the web-based management interface of Citrix SD-WAN (formerly NetScaler SD-WAN) appliances. The vulnerability exists because the management interface does not properly sanitize user-supplied input in certain administrative functions before incorporating it into operating system commands. An authenticated attacker with access to the management interface can craft requests containing shell metacharacters that escape the intended command context and execute arbitrary commands on the underlying operating system. The commands execute with the privileges of the web application, which typically has elevated or root-level access to perform system administration tasks.
Frequently Asked Questions
Is CVE-2019-12991 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2019-12991 and added it to the Known Exploited Vulnerabilities catalog. The EPSS score of 97.3% indicates near-certain exploitation for exposed appliances.
What products are affected by CVE-2019-12991?
CVE-2019-12991 affects Citrix SD-WAN and NetScaler SD-WAN appliances. These are enterprise network infrastructure devices used for managing and optimizing wide-area network connectivity.
How do I fix CVE-2019-12991?
Apply the latest firmware patches from Citrix that address CVE-2019-12991. Restrict management interface access to trusted networks, enforce multi-factor authentication, and audit all administrative accounts.
How severe is CVE-2019-12991?
CVE-2019-12991 is a high-severity command injection vulnerability. While authentication is required, it enables complete system compromise of critical network infrastructure. Attackers can chain this with other vulnerabilities to gain initial access.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.