Login Request a demo
High severity · published Jul 10, 2020
CVE-2020-8197
Privilege escalation vulnerability on Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 allows a low privileged user with…
8.8
CVSS
1.8%
EPSS
No
On KEV
Description
Privilege escalation vulnerability on Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 allows a low privileged user with management access to execute arbitrary commands.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Application Delivery Controller Firmware · Citrix
10.5 before 10.5-70.18; 11.1 before 11.1-64.14; 12.0 before 12.0-63.21; 12.1 before 12.1-57.18; 13.0 before 13.0-58.30 · source: NVD
GF
Gateway Firmware · Citrix
13.0 before 13.0-58.30 · source: NVD
NG
Netscaler Gateway Firmware · Citrix
10.5 before 10.5-70.18; 11.1 before 11.1-64.14; 12.0 before 12.0-63.21; 12.1 before 12.1-57.18 · source: NVD
Affected product
AD
Application Delivery Controller Firmware
Citrix
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-8197
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-8197
Vendor Advisory
https://support.citrix.com/article/CTX276688
More from Application Delivery Controller Firmware
9.8
CVE-2022-27518
Unauthenticated remote arbitrary code execution
9.8
CVE-2019-19781
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability
6.5
CVE-2020-8195
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability
6.5
CVE-2020-8193
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability
4.3
CVE-2020-8196
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability