What is CVE-2023-6548?

CVE-2023-6548 is a high-severity vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway systems. This vulnerability, known as a code injection, allows an attacker with low-privileged access to perform remote code execution on the management interface of these systems. The affected systems include specific version ranges of Citrix NetScaler ADC and NetScaler Gateway products. It's important for organizations using these systems to be aware of this vulnerability and take appropriate steps to mitigate the risk.

Who is impacted by this?

The CVE-2023-6548 vulnerability affects users of Citrix NetScaler ADC and NetScaler Gateway systems with access to NSIP, CLIP, or SNIP with a management interface. The impacted versions include NetScaler ADC versions from 12.1 up to 12.1-55.302, 13.0 up to 13.0-92.21, 13.1 up to 13.1-51.15, and 14.1 up to 14.1-12.35. For NetScaler Gateway, affected versions range from 13.0 up to 13.0-92.21, 13.1 up to 13.1-51.15, and 14.1 up to 14.1-12.35. This vulnerability allows an attacker with low-privileged access to perform remote code execution on the management interface of these systems.

What should I do if I’m affected?

If you're affected by the CVE-2023-6548 vulnerability, it's crucial to take action to protect your systems. First, check if your system is running an affected version of Citrix NetScaler ADC or NetScaler Gateway. If so, follow these steps:

1. Separate network traffic to the appliance's management interface from normal network traffic, either physically or logically.

2. Do not expose the management interface to the internet.

3. Download and apply the appropriate patch for your system from the Citrix website.

By following these steps, you can help mitigate the risk posed by this vulnerability and keep your systems secure.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-6548 vulnerability, also known as Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability, is indeed listed in CISA's Known Exploited Vulnerabilities Catalog. It was added on January 17, 2024, with a due date of January 24, 2024, for required action. Organizations affected by this vulnerability should apply mitigations as per vendor instructions or discontinue the product's use if mitigations are unavailable.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-94, which refers to improper control of code generation, or code injection.

Learn More

CVE-2023-6548 is a significant vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway systems. For a comprehensive understanding of its description, severity, technical details, and affected software configurations, refer to the NVD page and the sources listed below.

• NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2023-6548 and CVE-2023-6549

• BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

• Known Exploited Vulnerabilities Catalog