This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Citrix fixes 5 vulnerabilities

Citrix fixes 5 vulnerabilities in various products. Individual products and their fixed versions: NetScaler ADC [1] - 14.1-43.56 - 13.1-58.32 - 13.1-37.235 (FIPS and NDcPP) - 12.1-55.328 (FIPS) NetScaler Gateway [1] - 14.1-43.56 - 13.1-58.32 Citrix Secure Access Client for Windows [2] - 25.5.1.15 Citrix Workspace app for Windows [3] - 2409 (CR) - 2402 LTSR CU2 Hotfix 1, 2402 LTSR CU3 Hotfix 1 NetScaler Console and NetScaler SDX (SVM) [4] - 14.1.47.46 - 13.1.58.32

Citrix NetScaler ADC and NetScaler Gateway - out-of-bounds read (CVE-2025-5777)
CVSS 9.3 (Critical)

An unauthenticated remote attacker can read data outside the allocated memory range due to insufficient input validation in NetScaler ADC and NetScaler Gateway, if the products are configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server. After updating, it is recommended to terminate all active ICA and PCoIP sessions using the commands 'kill icaconnection -all' and 'kill pcoipConnection -all'. More information, including the impact on Secure Private Access on-prem/hybrid deployments, can be found at [1].

The vulnerability is present in products:

  • NetScaler ADC; >=13.1, <13.1-58.32; >=14.1, <14.1-43.56;
  • NetScaler ADC; >=12.1-FIPS, <12.1-55.328-FIPS; >=13.1-FIPS, <13.1-37.235-FIPS;
  • NetScaler ADC; >=13.1-NDcPP, <13.1-37.235-NDcPP;
  • NetScaler Gateway; >=13.1, <13.1-58.32; >=14.1, <14.1-43.56;

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

More information:

The vulnerability was publicly disclosed 17. 6. 2025.

Citrix NetScaler ADC and NetScaler Gateway - unauthorized access (CVE-2025-5349)
CVSS 8.7 (High)

An unauthenticated remote attacker with access to the NSIP, Cluster Management IP or local GSLB Site IP can gain unauthorized access to the system management interface (NetScaler Management Interface) due to insufficient access control in NetScaler ADC and NetScaler Gateway. After updating, it is recommended to terminate all active ICA and PCoIP sessions using the commands 'kill icaconnection -all' and 'kill pcoipConnection -all'. More information, including the impact on Secure Private Access on-prem/hybrid deployments, can be found at [1].

The vulnerability is present in products:

  • NetScaler ADC; >=13.1, <13.1-58.32; >=14.1, <14.1-43.56;
  • NetScaler ADC; >=12.1-FIPS, <12.1-55.328-FIPS; >=13.1-FIPS, <13.1-37.235-FIPS;
  • NetScaler ADC; >=13.1-NDcPP, <13.1-37.235-NDcPP;
  • NetScaler Gateway; >=13.1, <13.1-58.32; >=14.1, <14.1-43.56;

CVSS: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

More information:

The vulnerability was publicly disclosed 17. 6. 2025.

Citrix Secure Access Client for Windows - privilege escalation (CVE-2025-0320)
CVSS 8.5 (High)

An authenticated local attacker can escalate privileges and obtain system rights (SYSTEM) in Citrix Secure Access Client for Windows [2].

The vulnerability is present in product:

  • Citrix Secure Access Client for Windows; <25.5.1.15;

CVSS: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 17. 6. 2025.

Citrix Workspace app for Windows - privilege escalation (CVE-2025-4879)
CVSS 7.3 (High)

An authenticated local attacker can escalate privileges and obtain system rights (SYSTEM) in Citrix Workspace app for Windows with the App Protection service active [3].

The vulnerability is present in products:

  • Citrix Workspace app for Windows (CR); <2409;
  • Citrix Workspace app for Windows (LTSR); <2402 LTSR CU2 Hotfix 1; >2402 LTSR CU2 Hotfix 1, <2402 LTSR CU3 Hotfix 1;

CVSS: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 17. 6. 2025.

Citrix NetScaler Console and NetScaler SDX (SVM) - arbitrary file read (CVE-2025-4365)
CVSS 6.9 (Medium)

An authenticated remote attacker can read arbitrary files due to insufficient access control in NetScaler Console (customer-managed) and NetScaler SDX (SVM) [4].

The vulnerability is present in products:

  • NetScaler Console; >=13.1, <13.1.58.32; >=14.1, <14.1.47.46;
  • NetScaler SDX (SVM); >=13.1, <13.1.58.32; >=14.1, <14.1.47.46;

CVSS: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 17. 6. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 23. 6. 2025.

CESNET, z.s.p.o. Logo