CVE-2023-6548

Timeline

Detection, updates, and resolution for this record.

1. Jan 17, 2024 · Catalog

   Detected

   Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.

2. Jan 17, 2024 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

3. Jan 24, 2024 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

4. Jun 16, 2026 · Catalog

   Updated

   Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.

Affected

• cpe citrix/netscaler application delivery controllerversion unspecified
• cpe citrix/netscaler gatewayversion unspecified
• vendor Citrix NetScaler ADC and NetScaler Gatewayversion unspecified

Sources

• CISA KEVCVE-2023-6548

  Citrix NetScaler ADC and NetScaler Gateway contain a code injection vulnerability that allows for authenticated remote code execution on the management interface with access to NSIP, CLIP, or SNIP.

  cisa.gov
• CVE.orgCVE-2023-6548

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2023-6548

  30-day exploitation probability 3.2%

  first.org
• NIST NVDCVE-2023-6548

  Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.

  nvd.nist.gov

References

• CISA note · nvd.nist.gov
• CISA note · support.citrix.com
• US Government Resource · cisa.gov