Citrix · NetScaler ADC and Gateway
CVE-2025-6543
Memory overflow vulnerability leading to unintended control flow and Denial of Service
무엇인가
Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
CISA: Citrix NetScaler ADC and Gateway contain a buffer overflow vulnerability leading to unintended control flow and Denial of Service. NetScaler must be configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.
할 일
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
미국 연방 기관 조치 기한: 2025년 7월 21일
Citrix의 다른 악용된 결함
| 추가됨 | 취약점 | 제품 | 심각도 | 공격 가능성 |
|---|---|---|---|---|
| 2025. 7. 10. | Out-of-Bounds Read | NetScaler ADC and Gateway | 치명적 9.3 | >99.9% |
| 2026. 10. 4. | Improper Restriction of Operations within the Bounds of a Memory Buffer | NetScaler | 높음 8.7 | 11% |
| 2026. 9. 27. | Improper Input Validation | NetScaler | 치명적 9.5 | 82% |
| 2026. 9. 27. | Improper Restriction of Operations within the Bounds of a Memory Buffer | NetScaler | 치명적 9.5 | 78% |
| 2026. 9. 9. | Authentication Bypass Using an Alternate Path or Channel | NetScaler | 치명적 9.3 | 33% |
| 2026. 8. 26. | Improper Restriction of Operations within the Bounds of a Memory Buffer | NetScaler ADC and NetScaler Gateway | 높음 8.8 | 1.0% |
| 2026. 3. 30. | Out-of-Bounds Read | NetScaler | 치명적 9.3 | 91% |
| 2025. 8. 26. | Memory Overflow | NetScaler | 치명적 9.2 | 21% |
출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.