CVE-2023-6548 kev in the critical feed json
Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CL…
published 2024-01-17 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-58778
- cvss
- 5.5
- version 3.1, CNA
- cisa kev
- Exploited
- added 2024-01-17
- epss
- 3.2%
- EPSS 3.2% chance of exploitation in 30 days, percentile 88%
- public exploits
- 0
- none known
Summary
Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.
Patch / fix
cisa required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Cloud Software Group NetScaler ADC 12.35, 37.176, 51.15, 55.302, 92.21
- Cloud Software Group NetScaler Gateway 12.35, 51.15, 92.21
- citrix netscaler_application_delivery_controller 12.1-55.302, 13.0-92.21, 13.1-37.176, 13.1-51.15, 14.1-12.35
- citrix netscaler_gateway 13.0-92.21, 13.1-51.15, 14.1-12.35
Timeline
- Added to CISA KEV
- Published
- CISA SSVC: exploitation active
- CISA patch deadline
Known exploited
- Added
- 2 y ago
- Patch by
- 2024-01-24 (2 y ago)
- Ransomware
- Not known
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Vendor, product
- Citrix, NetScaler ADC and NetScaler Gateway
- CISA name
- Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
ATT&CK techniques
How it is exploited and what it leads to, in MITRE ATT&CK terms.
- T1055 Process Injection exploitation
kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
3.19% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Cloud Software Group NetScaler ADC
- Cloud Software Group NetScaler Gateway
- citrix netscaler_application_delivery_controller
- citrix netscaler_gateway
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
- Technology feeds
References
-
support.citrix.com
/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549
vendor-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-6548
government-resource, us-government-resource
Sources
- CVE List CVE-2023-6548
- NVD CVE-2023-6548
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.