[ CVE-2019-12991 · Published 16 Jul 2019 ]
Citrix SD-WAN and NetScaler Command Injection Vulnerability
Exploited · CISA KEV CVSS 8.8
EPSS 74%No fix listed yet
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-03-25
- EPSS: 74% chance of exploitation in the next 30 days (higher than 99% of CVEs)
[ Description ]Official description
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6).
CISA: Authenticated Command Injection in Citrix SD-WAN Appliance and NetScaler SD-WAN Appliance.
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 15 Apr 2022): Apply updates per vendor instructions.
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ References ]References
- packetstormsecurity.com/files/153638/Citrix-SD-WAN-Appliance-10.2.2-Authentication-Bypa…ExploitThird Party AdvisoryVDB Entry
- www.securityfocus.com/bid/109133Broken LinkThird Party AdvisoryVDB Entry
- support.citrix.com/article/CTX251987Vendor Advisory
- www.tenable.com/security/research/tra-2019-32ExploitThird Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource