CVE-2023-6549
Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability
Description
CVE-2023-6549 is a high-severity vulnerability in Citrix NetScaler ADC and NetScaler Gateway that allows unauthenticated remote attackers to cause a Denial of Service condition and perform out-of-bounds memory reads. The flaw arises from improper restriction of operations within the bounds of a memory buffer (CWE-119) and carries a CVSS v3.1 score of 8.2. With an EPSS score of 0.786 (99th percentile), exploitation is statistically very likely, and CISA has included this CVE in the Known Exploited Vulnerabilities catalog with a remediation deadline of February 7, 2024. Organizations relying on Citrix NetScaler for load balancing and secure remote access should treat this as urgent and apply vendor-provided patches without delay.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| citrix | netscaler application delivery controller | >= 12.1, < 12.1-55.302; >= 13.0, < 13.0-92.21; >= 13.1, < 13.1-37.176; >= 13.1, < 13.1-51.15; >= 14.1, < 14.1-12.35 |
| citrix | netscaler gateway | >= 13.0, < 13.0-92.21; >= 13.1, < 13.1-51.15; >= 14.1, < 14.1-12.35 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
Weakness Type
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2023-6549 is classified under CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer. This weakness describes a broad class of memory safety errors where software performs read or write operations on a memory buffer without adequate boundary checks, potentially accessing memory outside the intended buffer region.
In this vulnerability, the NetScaler ADC and NetScaler Gateway fail to properly validate the bounds of memory buffer operations in certain processing paths. This allows an unauthenticated attacker to trigger out-of-bounds memory reads remotely, which can disclose memory contents and cause the service to crash. The absence of any authentication requirement compounds the severity, as any network-accessible attacker can initiate exploitation without credentials.
Impact Analysis
Confidentiality Impact (NONE): The CVSS rating assigns no confidentiality impact, indicating that data disclosure is not the primary risk. However, out-of-bounds reads may expose fragments of memory content; this is assessed as limited in practical data disclosure capability in the scoring.
Integrity Impact (LOW): There is a limited integrity impact; while the primary vector is denial of service, incidental memory manipulation during exploitation may produce minor integrity side effects.
Availability Impact (HIGH): The most significant impact is availability. An unauthenticated attacker can crash or destabilize the NetScaler ADC or Gateway service, rendering load balancing, SSL offloading, and remote access functionality unavailable. For organizations that rely on these appliances for VPN access and application delivery, this constitutes a critical operational disruption.
Scope: The attack vector is network-accessible with no authentication or user interaction required and low attack complexity. NetScaler devices are frequently internet-facing, making this vulnerability particularly dangerous for organizations that expose management or data plane interfaces to the public internet.
Exploit Maturity
Exploitation Status: CVE-2023-6549 is confirmed as actively exploited in the wild. CISA listed it in the Known Exploited Vulnerabilities catalog with a remediation deadline of February 7, 2024, confirming observed exploitation by threat actors.
EPSS Score: The EPSS score of 0.786 places this vulnerability in the 99th percentile (99.01%) of all CVEs by exploitation likelihood. This is an extremely high statistical probability, consistent with the confirmed active exploitation status.
Ransomware Association: The KEV entry records ransomware association as Unknown. No confirmed direct link to ransomware campaigns has been documented for this specific CVE.
Attack Conditions: Exploitation requires no authentication and no user interaction. The attacker only needs network access to the affected NetScaler ADC or NetScaler Gateway. Given that these devices are frequently deployed at the network perimeter and exposed to the internet, the attack surface is broad.
Remediation
- Apply Citrix patches immediately: Follow the security guidance published by Citrix in security bulletin CTX584986. Citrix released patches addressing both CVE-2023-6548 and CVE-2023-6549 — apply the applicable update for your installed version and product type.
- Verify your NetScaler version: Identify the exact version of NetScaler ADC and NetScaler Gateway deployed in your environment and cross-reference against the affected version list in the Citrix advisory to confirm patch applicability.
- Restrict management interface access: Until patching is complete, limit network access to the NetScaler management interface to trusted IP ranges only. Apply firewall rules or ACLs to block unauthenticated external access.
- Monitor for denial-of-service indicators: Review NetScaler logs and monitoring dashboards for unusual service restarts, crashes, or degraded performance that may indicate exploitation attempts.
- Prioritize internet-facing appliances: If multiple NetScaler instances are deployed, prioritize patching those exposed directly to the internet or to untrusted networks.
- Discontinue use if patching is not possible: Per CISA's KEV required action, if vendor mitigations cannot be applied, consider discontinuing use of the affected product to avoid exploitation.
- Check for co-occurring CVE-2023-6548: This CVE was disclosed alongside CVE-2023-6548 (Authenticated RCE in NetScaler). Apply patches addressing both vulnerabilities from the same Citrix advisory.
Technical Details
Vulnerability Class: Improper restriction of operations within the bounds of a memory buffer (CWE-119), enabling unauthenticated Denial of Service and out-of-bounds memory reads.
Affected Products: Citrix NetScaler Application Delivery Controller (ADC) and Citrix NetScaler Gateway — specific affected versions are detailed in the Citrix security bulletin CTX584986.
Attack Vector: Network (AV:N) — remotely exploitable without physical or adjacent-network access.
Authentication Required: None (PR:N) — no credentials needed. No user interaction required (UI:N).
Mechanism: The vulnerability resides in processing logic within NetScaler ADC and NetScaler Gateway where memory buffer boundary checks are insufficient. A specially crafted network request can cause the application to read beyond the allocated buffer boundaries, resulting in service crashes (denial of service) or potentially leaking adjacent memory contents.
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CWE Classification: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
Related CVE: CVE-2023-6548 — a separate authenticated code injection vulnerability in the same products, disclosed and patched concurrently.
Frequently Asked Questions
Is CVE-2023-6549 related to CVE-2023-6548?
Yes, both CVEs were disclosed together by Citrix in the same security bulletin (CTX584986) and affect NetScaler ADC and NetScaler Gateway. However, they are distinct vulnerabilities. CVE-2023-6549 (this CVE) allows unauthenticated denial of service and out-of-bounds memory reads from the network. CVE-2023-6548 is a separate authenticated code injection flaw requiring low-privilege access to a management interface. The Citrix advisory provides a single patch addressing both issues.
Do I need to be authenticated to exploit CVE-2023-6549?
No. CVE-2023-6549 can be exploited by an unauthenticated attacker with network access to the affected NetScaler ADC or Gateway. No credentials, user interaction, or elevated privileges are required, which significantly increases the risk for internet-facing deployments.
What is the primary impact of CVE-2023-6549?
The primary impact is a denial of service — an attacker can crash or destabilize the NetScaler ADC or Gateway service, causing outages for application delivery, load balancing, and VPN/remote access functionality that depends on these appliances. Additionally, out-of-bounds memory reads may expose limited memory content, though the CVSS rating reflects no material confidentiality impact.
Which NetScaler versions are affected?
Specific affected version ranges are detailed in the Citrix security bulletin CTX584986. Both NetScaler ADC (Application Delivery Controller) and NetScaler Gateway are affected. Organizations should consult the official Citrix advisory to determine whether their installed firmware version falls within the affected range and to obtain the appropriate patched release.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.