CVE-2022-27518criticalunder attackCWE-664

CVE-2022-27518: critical vulnerability in Citrix Gateway, Citrix ADC

Unauthenticated remote arbitrary code execution

Published · Updated

Follow this CVE+ Monitor NetScaler Gateway+ Monitor NetScaler ADC

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

78Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 9.8epss 6.9%
from disclosure to weapon35 days
Published on NVDDec 13
1st PoC+35d
CISA KEVDec 13
Action required by CISAfederal deadline: 2023-01-03

Apply updates per vendor instructions.

In short

An attacker can execute arbitrary code on a vulnerable server without needing to log in. This is critical because it allows complete takeover of the system from the internet.

Technical detail

CWE-664 vulnerability enabling unauthenticated remote code execution with CVSS 9.8 severity. Attackers can exploit this without authentication by sending crafted requests to the vulnerable application, resulting in arbitrary code execution with the privileges of the affected service.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Unauthenticated remote arbitrary code execution
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Citrix · Citrix Gateway, Citrix ADC
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Citrix Gateway, Citrix ADC

In the same product, most dangerous first.

CVE-2022-27510CRITICALUnauthorized access to Gateway user capabilities EPSS 1.3%CVE-2022-27516MEDIUMUser login brute force protection functionality bypass EPSS 0.7%CVE-2022-27513HIGHRemote desktop takeover via phishingEPSS 0.3%