Application Delivery Controller Firmware vulnerabilities

Product

Application Delivery Controller Firmware

by Citrix · last CVE Dec 26, 2022

On CISA KEVExploited in the wildRansomware-linked

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities30 In the news0 Timeline

Severity mix

Critical 7High 10Medium 13Low 0

Severity

All severities30 Critical7 High10 Medium13 Low0

Exploitation

On CISA KEV5 Exploited in the wild5

Watch

Add Application Delivery Controller Firmware to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2022-27518 In wildKEV	9.8	7%	Dec 13	Unauthenticated remote arbitrary code execution Affected: 12.1 before 12.1-55.291; 12.1 before 12.1-55.291; 12.1 before 12.1-65.25; 13.0 before 13.0-58.32
CVE-2019-19781 RansomwareIn wildKEV	9.8	100%	Dec 27	Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability Affected: 10.5; 11.1; 12.0; 12.1; 13.0
CVE-2020-8195 In wildKEV	6.5	33%	Jul 10	Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability Affected: 10.5 before 10.5-70.18; 11.1 before 11.1-64.14; 12.0 before 12.0-63.21; 12.1 before 12.1-57.18; 13.0 before 13.0-58.30
CVE-2020-8193 In wildKEV	6.5	88%	Jul 10	Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability Affected: 10.5 before 10.5-70.18; 11.1 before 11.1-64.14; 12.0 before 12.0-63.21; 12.1 before 12.1-57.18; 13.0 before 13.0-58.30
CVE-2020-8196 In wildKEV	4.3	26%	Jul 10	Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability Affected: 10.5 before 10.5-70.18; 11.1 before 11.1-64.14; 12.0 before 12.0-63.21; 12.1 before 12.1-57.18; 13.0 before 13.0-58.30
CVE-2022-27516	9.8	1%	Nov 8	User login brute force protection functionality bypass Affected: 12.1 before 12.1-65.21; 13.0 before 13.0-88.12; 13.1 before 13.1-33.47; 12.1 before 12.1-55.289; 12.1 before 12.1-55.289
CVE-2022-27510	9.8	1%	Nov 8	Unauthorized access to Gateway user capabilities Affected: 12.1 before 12.1-65.21; 13.0 before 13.0-88.12; 13.1 before 13.1-33.47; 12.1 before 12.1-55.289; 12.1 before 12.1-55.289
CVE-2019-18225	9.8	2%	Oct 21	An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway before 10.5 build 70.8, 11.x before 11.1 build 63.9, 12.0 before build 62.10, 12.1 before build… Affected: 10.5; 11.1; 12.0; 12.1; 13.0
CVE-2018-7218	9.8	6%	May 17	The AppFirewall functionality in Citrix NetScaler Application Delivery Controller and NetScaler Gateway 10.5 before Build 68.7, 11.0 before Build 71.24, 11.1 before Build 58.13,… Affected: 10.5; 11.0; 11.1; 12.0
CVE-2022-27513	9.6	0%	Nov 8	Remote desktop takeover via phishing Affected: 12.1 before 12.1-65.21; 13.0 before 13.0-88.12; 13.1 before 13.1-33.47; 12.1 before 12.1-55.289; 12.1 before 12.1-55.289
CVE-2020-8247	8.8	1%	Sep 18	Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler… Affected: 11.1 before 11.1-65.12; 12.1 before 12.1-58.15; 13.0 before 13.0-64.35
CVE-2020-8197	8.8	2%	Jul 10	Privilege escalation vulnerability on Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 allows a low privileged user with… Affected: 10.5 before 10.5-70.18; 11.1 before 11.1-64.14; 12.0 before 12.0-63.21; 12.1 before 12.1-57.18; 13.0 before 13.0-58.30
CVE-2021-22927	8.1	1%	Aug 5	A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider that could allow an attacker to hijack a session Affected: 11.1 before 11.1-65.22; 12.1 before 12.1-62.27; 13.0 before 13.0-82.45; 12.1 before 12.1-55.238
CVE-2021-22956	7.5	1%	Dec 7	An uncontrolled resource consumption vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 that could allow an attacker with access to NSIP or SNIP with… Affected: before 11.1-65.23; 12.1 before 12.1-63.22; 13.0 before 13.0-83.27
CVE-2021-22955	7.5	1%	Dec 7	A unauthenticated denial of service vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 when configured as a VPN (Gateway) or AAA virtual server could allow… Affected: through 11.1-65.23; 12.1 before 12.1-63.22; 13.0 before 13.0-83.27
CVE-2021-22919	7.5	1%	Aug 5	A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN WANOP Edition… Affected: 11.1 before 11.1-65.22; 12.1 before 12.1-62.27; 13.0 before 13.0-82.45; 12.1 before 12.1-55.238
CVE-2020-8246	7.5	2%	Sep 18	Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler… Affected: 11.1 before 11.1-65.12; 12.1 before 12.1-58.15; 13.0 before 13.0-64.35
CVE-2020-8190	7.5	1%	Jul 10	Incorrect file permissions in Citrix ADC and Citrix Gateway before versions 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 allows privilege escalation Affected: 10.5 before 10.5-70.18; 11.1 before 11.1-64.14; 12.0 before 12.0-63.21; 12.1 before 12.1-57.18; 13.0 before 13.0-58.30
CVE-2020-8187	7.5	2%	Jul 10	Improper input validation in Citrix ADC and Citrix Gateway versions before 11.1-63.9 and 12.0-62.10 allows unauthenticated users to perform a denial of service attack Affected: 11.1 before 11.1-63.9; 12.0 before 12.0-62.10
CVE-2017-14602	7.2	2%	Sep 26	A vulnerability has been identified in the management interface of Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.1 before build 135.18, 10.5… Affected: 10.1; 10.5; 10.5e; 11.0; 11.1; 12.0
CVE-2019-18177	6.5	1%	Dec 26	In certain Citrix products, information disclosure can be achieved by an authenticated VPN user when there is a configured SSL VPN endpoint Affected: before 13.0-58.30
CVE-2020-8300	6.5	3%	Jun 16	Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML… Affected: 11.1 before 11.1-65.20; 12.1 before 12.1-62.23; 13.0 before 13.0-82.41; 12.1 before 12.1-55.238
CVE-2020-8299	6.5	0%	Jun 16	Citrix ADC and Citrix/NetScaler Gateway 13.0 before 13.0-76.29, 12.1-61.18, 11.1-65.20, Citrix ADC 12.1-FIPS before 12.1-55.238, and Citrix SD-WAN WANOP Edition before 11.4.0,… Affected: 11.1 before 11.1-65.20; 12.1 before 12.1-61.18; 13.0 before 13.0-76.29; 12.1 before 12.1-55.238
CVE-2020-8194	6.5	11%	Jul 10	Reflected code injection in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before… Affected: 10.5 before 10.5-70.18; 11.1 before 11.1-64.14; 12.0 before 12.0-63.21; 12.1 before 12.1-57.18; 13.0 before 13.0-58.30
CVE-2022-27509	6.1	1%	Jul 28	Unauthenticated redirection to a malicious website Affected: 12.1 before 12.1-65.15; 13.0 before 13.0-86.17; 13.1 before 13.1-24.38; 12.1 before 12.1-55.282; 12.1 before 12.1-55.282
CVE-2020-8245	6.1	1%	Sep 18	Improper Input Validation on Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before… Affected: 11.1 before 11.1-65.12; 12.1 before 12.1-58.15; 13.0 before 13.0-64.35
CVE-2020-8198	6.1	1%	Jul 10	Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before… Affected: 10.5 before 10.5-70.18; 11.1 before 11.1-64.14; 12.0 before 12.0-63.21; 12.1 before 12.1-57.18; 13.0 before 13.0-58.30
CVE-2020-8191	6.1	23%	Jul 10	Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before… Affected: 10.5 before 10.5-70.18; 11.1 before 11.1-64.14; 12.0 before 12.0-63.21; 12.1 before 12.1-57.18; 13.0 before 13.0-58.30
CVE-2017-17549	5.9	2%	Dec 13	Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.5 before build 67.13, 11.0 before build 71.22, 11.1 before build 56.19, and 12.0 before build 53.22… Affected: 10.5; 11.0; 11.1; 12.0
CVE-2017-17382	5.9	14%	Dec 13	Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.5 before build 67.13, 11.0 before build 71.22, 11.1 before build 56.19, and 12.0 before build 53.22… Affected: 10.5; 11.0; 11.1; 12.0