CVE-2025-6543
Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability
Description
CVE-2025-6543 is a critical memory overflow vulnerability in Citrix NetScaler ADC and NetScaler Gateway that can lead to unintended control flow changes and denial of service. The vulnerability affects the Gateway component when configured as a VPN virtual server, ICA Proxy, CVPN, or RDP Proxy, allowing an unauthenticated remote attacker to trigger a buffer overflow that corrupts memory and disrupts appliance operations. With a CVSS v3.1 score of 9.8, this vulnerability requires no authentication, no user interaction, and is trivially exploitable over the network. CISA added CVE-2025-6543 to the Known Exploited Vulnerabilities catalog with a deadline of July 21, 2025, and its EPSS score of 2.71% at the 86th percentile indicates growing exploitation activity against Citrix network appliances.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| citrix | netscaler application delivery controller | >= 13.1, < 13.1-37.236; >= 13.1, < 13.1-59.19; >= 14.1, < 14.1-47.46 |
| citrix | netscaler gateway | >= 13.1, < 13.1-59.19; >= 14.1, < 14.1-47.46 |
References
- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694788(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6543(US Government Resource)
Weakness Type
CWE-119: Buffer Overflow
CVE-2025-6543 is classified under CWE-119, Improper Restriction of Operations within the Bounds of a Memory Buffer. In the NetScaler ADC and Gateway, certain network request processing operations write data beyond the allocated buffer boundaries, corrupting adjacent memory regions. This memory overflow can alter program execution flow, leading to denial of service and potentially enabling remote code execution on the affected appliance.
Learn more: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
Impact Analysis
CVE-2025-6543 carries maximum impact across all CIA dimensions, making it one of the most critical vulnerabilities affecting Citrix infrastructure. The attack is remotely exploitable (AV:N) with low complexity (AC:L), requiring no authentication (PR:N) and no user interaction (UI:N). Confidentiality, integrity, and availability are all rated high (C:H/I:H/A:H), as the memory overflow can be leveraged to read sensitive data from device memory, modify program execution flow to achieve arbitrary code execution, and crash the appliance causing denial of service. NetScaler ADC and Gateway appliances sit at the network perimeter handling VPN connections, application delivery, and authentication for entire organizations — a compromise at this layer provides an attacker with a foothold from which they can intercept credentials, hijack sessions, and pivot into the internal network. The EPSS score of 2.71% at the 86th percentile indicates above-average and growing exploitation activity, consistent with threat actors actively targeting Citrix appliances following the pattern established by CitrixBleed and other recent NetScaler vulnerabilities.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2025-6543 by adding it to the Known Exploited Vulnerabilities catalog. The EPSS score of 2.71% at the 86th percentile indicates growing exploitation activity, with the score likely to increase as more threat actors incorporate this vulnerability into their toolkits. The Citrix advisory (CTX694788) provides the vendor disclosure, and the NetScaler blog addresses this vulnerability alongside CVE-2025-5777 (CitrixBleed 2). The co-disclosure of these two critical NetScaler vulnerabilities heightens the risk, as threat actors targeting one are likely to also exploit the other. Given Citrix NetScaler's history as a prime target for ransomware groups and APT operators, organizations should prioritize patching with the same urgency applied to CitrixBleed campaigns.
Remediation
-
Apply the Citrix security update immediately. Upgrade NetScaler ADC to version 13.1-37.236, 13.1-59.19, or 14.1-47.46 (depending on your branch), and NetScaler Gateway to version 13.1-59.19 or 14.1-47.46. Refer to CTX694788 for specific upgrade paths.
-
Restrict access to Gateway virtual server services where possible. Implement IP-based access controls to limit VPN and proxy connections to known, trusted networks. Consider deploying a network-level firewall rule to rate-limit connections to the affected services during the patching window.
-
Monitor for exploitation indicators on all NetScaler appliances, including unexpected crashes, memory corruption errors in system logs, and abnormal traffic patterns targeting VPN and proxy endpoints. Review netscaler logs for access patterns consistent with exploitation attempts.
-
Patch CVE-2025-5777 simultaneously if not already addressed. Both vulnerabilities were disclosed together and affect the same NetScaler components. Applying the latest cumulative update addresses both CVEs.
-
Implement network segmentation and zero-trust controls between the NetScaler appliance and internal network resources. Even after patching, deploy monitoring for lateral movement from the appliance tier and rotate any credentials or session tokens that may have been exposed during the vulnerability window.
Technical Details
CVE-2025-6543 is a memory overflow vulnerability in Citrix NetScaler ADC and NetScaler Gateway, with the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicating maximum exploitability and full CIA impact. The vulnerability manifests when the NetScaler appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) and processes specially crafted network requests. Insufficient bounds checking in the request processing logic allows input data to overflow allocated memory buffers, corrupting adjacent memory regions and potentially overwriting critical data structures including function pointers and control flow metadata. The memory overflow leads to "unintended control flow" as described in the Citrix advisory, which in security terms means the attacker can redirect program execution to attacker-controlled code. This vulnerability is distinct from but related to CVE-2025-5777, which affects the same NetScaler components with a memory disclosure rather than overflow. The affected versions include NetScaler ADC 13.1 through 14.1 and NetScaler Gateway 13.1 through 14.1, with fixes delivered in the same cumulative security updates that address CVE-2025-5777.
Frequently Asked Questions
Is CVE-2025-6543 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2025-6543 to the KEV catalog. The vulnerability was disclosed alongside CVE-2025-5777 (CitrixBleed 2), and threat actors are targeting both flaws against internet-facing NetScaler appliances.
What products are affected by CVE-2025-6543?
Citrix NetScaler ADC versions 13.1 through 14.1 and NetScaler Gateway versions 13.1 through 14.1 are affected when configured as a Gateway or proxy. Specific fix versions are NetScaler ADC 13.1-37.236, 13.1-59.19, 14.1-47.46 and NetScaler Gateway 13.1-59.19, 14.1-47.46.
How do I fix CVE-2025-6543?
Upgrade to the patched NetScaler version for your branch immediately. Apply the latest cumulative security update, which addresses both CVE-2025-6543 and CVE-2025-5777. Refer to Citrix advisory CTX694788 for detailed guidance.
How severe is CVE-2025-6543?
With a CVSS score of 9.8 (Critical), CVE-2025-6543 is one of the most severe vulnerabilities affecting network infrastructure. The memory overflow enables unauthenticated remote exploitation that can lead to complete appliance compromise, denial of service, and network infiltration.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.