[ CVE-2019-12989 · Published 16 Jul 2019 ]
Citrix SD-WAN and NetScaler SQL Injection Vulnerability
Exploited · CISA KEV CVSS 9.8
EPSS 95%No fix listed yet
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-03-25
- EPSS: 95% chance of exploitation in the next 30 days (higher than 100% of CVEs)
- Critical severity: CVSS 9.8
[ Description ]Official description
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.
CISA: Citrix SD-WAN and NetScaler SD-WAN allow SQL Injection.
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 15 Apr 2022): Apply updates per vendor instructions.
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ References ]References
- packetstormsecurity.com/files/153638/Citrix-SD-WAN-Appliance-10.2.2-Authentication-Bypa…ExploitThird Party AdvisoryVDB Entry
- www.securityfocus.com/bid/109133Broken LinkThird Party AdvisoryVDB Entry
- support.citrix.com/article/CTX251987Vendor Advisory
- www.tenable.com/security/research/tra-2019-32ExploitThird Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource