PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-6548 Citrix CVE debrief

CVE-2023-6548 is a Citrix NetScaler ADC and NetScaler Gateway code injection vulnerability that CISA added to the Known Exploited Vulnerabilities catalog on 2024-01-17. Because it is in KEV, affected organizations should treat it as a high-priority issue and follow Citrix’s vendor guidance immediately; CISA says to apply mitigations per vendor instructions or discontinue use if mitigations are unavailable.

Vendor
Citrix
Product
NetScaler ADC and NetScaler Gateway
CVSS
MEDIUM 5.5
CISA KEV
Listed
Original CVE published
2024-01-17
Original CVE updated
2024-01-17
Advisory published
2024-01-17
Advisory updated
2024-01-17

Who should care

Administrators and security teams responsible for Citrix NetScaler ADC and NetScaler Gateway deployments, especially internet-facing appliances and the teams that manage patching, mitigation, and exposure review.

Technical summary

The supplied sources identify this issue as a code injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway. CISA’s KEV listing confirms it is known to be exploited in the wild and directs defenders to use vendor mitigations or stop using the product if mitigations cannot be applied.

Defensive priority

Critical. KEV inclusion means active exploitation risk should be assumed and remediation should be accelerated to the shortest practical window.

Recommended defensive actions

  • Confirm whether any Citrix NetScaler ADC or NetScaler Gateway systems are in scope, including externally exposed instances.
  • Review Citrix’s security bulletin for CVE-2023-6548 and apply the vendor’s mitigations as soon as possible.
  • If mitigations are unavailable for a deployed instance, follow CISA guidance and discontinue use of the product.
  • Prioritize these systems ahead of routine maintenance because the vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog.
  • Increase monitoring around the affected appliances for unusual administrative activity or signs of compromise.

Evidence notes

CISA’s Known Exploited Vulnerabilities entry for CVE-2023-6548 lists Citrix NetScaler ADC and NetScaler Gateway, marks the issue as a code injection vulnerability, sets the KEV dateAdded to 2024-01-17 and dueDate to 2024-01-24, and instructs defenders to apply vendor mitigations or discontinue use if mitigations are unavailable. The source notes reference the Citrix security bulletin at https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-6548 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-6548

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-6548 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-6548

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.