This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Citrix fixes a critical vulnerability
Citrix fixes a critical vulnerability in its products [1]. Products and their fixed versions: NetScaler ADC: 13.1-59.19, 14.1-47.46, 13.1-37.236-FIPS, 13.1-37.236-NDcPP NetScaler Gateway: 13.1-59.19, 14.1-47.46
An unauthenticated remote attacker can perform a DoS attack if the product is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server. The vulnerability is already being actively exploited and also affects on-prem/Hybrid deployments of the Secure Private Access service [1].
The vulnerability is present in products:
- NetScaler ADC; >=12.1, <=12.1-65.39; >=13.1, <13.1-59.19; >=14.1, <14.1-47.46;
- NetScaler ADC; >=13.1-FIPS, <13.1-37.236-FIPS;
- NetScaler ADC; >=13.1-NDcPP, <13.1-37.236-NDcPP;
- NetScaler Gateway; >=12.1, <=12.1-65.39; >=13.1, <13.1-59.19; >=14.1, <14.1-47.46;
CVSS: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
More information:
- CVE-2025-6543 at cve.org, NVD
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer at cwe.mitre.org
The vulnerability was publicly disclosed 25. 6. 2025.
By CESNET, z.s.p.o. Michaela Ručková on 26. 6. 2025.