UpHeron
All vulnerabilities

Servers and applications

CVE-2023-6548

Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 17 Jan 2024.

Severity
High 8.8
Published
17 Jan 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
12.1-55.302, 13.0-92.21, 13.1-37.176, 13.1-51.15, 14.1-12.35
Sources
NVD

Affected software

SoftwareAffected versions
NetScaler ADC and GatewayServers and applications · cpe:a:citrix:netscaler_application_delivery_controller
  • From 12.1 before 12.1-55.302
  • From 13.0 before 13.0-92.21
  • From 13.1 before 13.1-37.176
  • From 13.1 before 13.1-51.15
  • From 14.1 before 14.1-12.35
NetScaler ADC and GatewayServers and applications · cpe:a:citrix:netscaler_gateway
  • From 13.0 before 13.0-92.21
  • From 13.1 before 13.1-51.15
  • From 14.1 before 14.1-12.35

Known exploited

CISA name
Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due for US agencies
24 Jan 2024
Used in ransomware
Not known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-6548
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-6548