High severity · published Jan 17, 2024
CVE-2023-6548
Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
In wildKEV
8.8
CVSS
3.2%
EPSS
Yes
On KEV
Description
Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.2% · higher than 88% of CVEs
Exploited in the wildYes
CISA KEVListed Jan 17, 2024
Federal remediation dueJan 24, 2024
Ransomware campaign useNot known
Affected products
Which versions
NA
NetScaler ADC · Citrix
12.1 before 12.1-55.302; 12.1 before 12.1-55.302; 13.0 before 13.0-92.21; 13.1 before 13.1-37.176; 13.1 before 13.1-51.15; 14.1 before 14.1-12.35 · source: NVD, CISA, vendor
NG
NetScaler Gateway · Cloud Software Group
14.1 before 12.35; 13.1 before 51.15; 13.0 before 92.21 · source: vendor
NA
NetScaler ADC and NetScaler Gateway · Citrix
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-6548
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-6548
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
support.citrix.com
https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549
More from NetScaler ADC
9.8
CVE-2026-88771
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
9.8
CVE-2026-19490
NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490
9.8
CVE-2026-8452
Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service
9.8
CVE-2026-3055
Insufficient input validation leading to memory overread
9.8
CVE-2025-7775
Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service