CVE-2023-6548
Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
Description
CVE-2023-6548 is a medium-severity authenticated remote code execution vulnerability in Citrix NetScaler ADC and NetScaler Gateway. An attacker with low-privileged access to the management interface — via NSIP, CLIP, or SNIP — can inject and execute arbitrary code on the management plane without requiring elevated privileges. The vulnerability carries a CVSS v3.1 score of 5.5 and was disclosed alongside CVE-2023-6549 in the same Citrix security bulletin. CISA has included CVE-2023-6548 in the Known Exploited Vulnerabilities catalog with a remediation deadline of January 24, 2024. Despite its medium CVSS rating, the confirmed active exploitation and its presence on widely deployed network appliances make this a high-priority remediation target.
KEV Information
CVSS Score
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| citrix | netscaler application delivery controller | >= 12.1, < 12.1-55.302; >= 13.0, < 13.0-92.21; >= 13.1, < 13.1-37.176; >= 13.1, < 13.1-51.15; >= 14.1, < 14.1-12.35 |
| citrix | netscaler gateway | >= 13.0, < 13.0-92.21; >= 13.1, < 13.1-51.15; >= 14.1, < 14.1-12.35 |
Multiple CVSS Assessments
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
Weakness Type
CWE-94: Improper Control of Generation of Code (Code Injection)
CVE-2023-6548 is classified under CWE-94: Improper Control of Generation of Code ("Code Injection"). This weakness occurs when software constructs code using externally influenced input without adequately neutralizing elements that can modify the intended code logic. In code injection scenarios, an attacker is able to introduce and execute arbitrary code within the application context.
In this case, the NetScaler management interface improperly handles input in a way that allows authenticated users with low privileges to inject code that is subsequently executed on the management interface host. This is particularly concerning given that the management interface of NetScaler appliances controls critical network infrastructure, and even low-privileged code execution in this context can have significant downstream consequences.
Impact Analysis
Confidentiality Impact (LOW): A low-privileged attacker executing code on the management interface can read configuration data, credentials, and management state information accessible to the process context in which code is injected.
Integrity Impact (LOW): Injected code can modify management configurations, alter routing or load-balancing rules, and potentially tamper with appliance settings within the scope of the compromised process.
Availability Impact (LOW): Code execution on the management interface could disrupt management plane functions, though full denial of service of the data plane would require additional actions.
Network Requirement: The attack vector is Adjacent Network (AV:A), meaning the attacker must have access to the same network segment as the NSIP, CLIP, or SNIP management interface. This limits the attack surface compared to internet-facing vulnerabilities, but management interfaces are often accessible from internal networks where low-privileged credentials may be available.
Escalation Potential: Although the CVSS score is medium (5.5), gaining code execution on a NetScaler management interface can serve as a stepping stone for lateral movement, privilege escalation, or full appliance compromise when combined with other vulnerabilities or misconfigurations.
Exploit Maturity
Exploitation Status: CVE-2023-6548 is confirmed as actively exploited in the wild. Its inclusion in CISA's Known Exploited Vulnerabilities catalog with a January 24, 2024 deadline reflects documented exploitation by threat actors.
EPSS Score: With an EPSS score of 0.0858 (92nd percentile), the statistical probability of exploitation is elevated relative to most CVEs. The 92nd percentile ranking indicates this vulnerability is significantly more likely to be exploited than the vast majority of known vulnerabilities.
Ransomware Association: The KEV entry records ransomware association as Unknown, meaning no confirmed direct link to ransomware campaigns has been documented for this specific vulnerability.
Attack Conditions: Exploitation requires low-privileged access (e.g., a valid management account with minimal rights) and adjacency to the management interface network. While this limits opportunistic internet-based exploitation, insider threats, compromised internal accounts, or attackers who have already gained a foothold on the internal network represent realistic threat actors.
Remediation
- Apply Citrix patches immediately: Consult and follow the Citrix security bulletin CTX584986, which addresses both CVE-2023-6548 and CVE-2023-6549. Install the appropriate patched firmware release for your NetScaler version and product type.
- Restrict management interface access: Ensure that NSIP, CLIP, and SNIP management interfaces are accessible only from dedicated, trusted management networks. Apply firewall ACLs to block access from general internal networks or the internet.
- Enforce principle of least privilege: Audit all management interface accounts. Revoke access for any accounts that do not have a legitimate need for management access. Review and reduce permissions to the minimum required.
- Audit management access logs: Review authentication and activity logs on the management interface for signs of unauthorized code injection or suspicious command execution prior to patching.
- Rotate management credentials: If exploitation is suspected, immediately rotate all management account credentials and API keys associated with the NetScaler management plane.
- Deploy network segmentation: Isolate NetScaler management interfaces on a dedicated out-of-band management network that is not accessible from regular user or server networks.
- Apply patches for CVE-2023-6549 simultaneously: Since both CVEs are addressed in the same Citrix advisory and share the same affected product, apply the single vendor patch that remediates both vulnerabilities at the same time.
Technical Details
Vulnerability Class: Improper control of code generation (code injection, CWE-94) in the management interface of Citrix NetScaler ADC and NetScaler Gateway.
Affected Products: Citrix NetScaler Application Delivery Controller (ADC) and Citrix NetScaler Gateway — specific affected versions are listed in the Citrix security bulletin CTX584986.
Attack Vector: Adjacent Network (AV:A) — the attacker must have network access to the NSIP, CLIP, or SNIP management interface, typically available on the internal management network.
Authentication Required: Low-privileged authentication (PR:L) — the attacker must possess a valid low-privilege management account. No user interaction required (UI:N).
Mechanism: The management interface processes input in a way that allows an authenticated low-privileged user to inject code that is executed in the context of the management interface service. The weakness (CWE-94) indicates that the software generates or interprets code based on externally provided input without adequate sanitization or isolation.
CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CWE Classification: CWE-94 (Improper Control of Generation of Code — Code Injection)
Related CVE: CVE-2023-6549 — a separate unauthenticated denial-of-service vulnerability in the same products, disclosed and patched in the same Citrix advisory.
Frequently Asked Questions
Does CVE-2023-6548 require admin-level credentials to exploit?
No. The vulnerability is exploitable by an attacker with low-privileged access to the NetScaler management interface — specifically via NSIP, CLIP, or SNIP. Full administrative rights are not required. This makes the attack realistic for insider threats or attackers who have previously compromised a low-privilege management account through phishing or credential theft.
Why is CVE-2023-6548 considered critical despite a CVSS score of 5.5?
The CVSS medium score reflects the limited per-attribute impact (low confidentiality, integrity, and availability) and the adjacent-network attack vector. However, the vulnerability is confirmed as actively exploited, affects widely deployed network infrastructure (Citrix NetScaler ADC and Gateway), and code execution on management interfaces can serve as a critical foothold for broader network compromise. The KEV listing reflects real-world threat actor interest that exceeds what the CVSS score alone conveys.
Is CVE-2023-6548 exploitable from the internet?
The attack vector is Adjacent Network (AV:A), meaning exploitation typically requires access to the same network segment as the NetScaler management interface (NSIP, CLIP, or SNIP). Internet-facing exploitation is therefore limited. However, if the management interface is exposed to the internet — a misconfiguration — the attack surface becomes much broader. Organizations should verify that management interfaces are not internet-accessible.
Is CVE-2023-6548 patched by the same update as CVE-2023-6549?
Yes. Citrix disclosed both CVE-2023-6548 and CVE-2023-6549 in the same security bulletin (CTX584986), and the remediation covers both vulnerabilities in a single firmware update for NetScaler ADC and Gateway. Organizations should apply the patch to address both CVEs simultaneously.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.