Improper access control on the NetScaler Management Interface (NetScaler ADC)
At a glance
- Source
- NVD
- EPSS
- EPSS 3.73 % · percentile 90 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Citrix
- NVD status
- Deferred
Description
Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway when an attacker can get access to the appliance NSIP, Cluster Management IP or local GSLB Site IP or SNIP with Management Access
Weaknesses (CWE)
- CWE-1284 — Improper Validation of Specified Quantity in Input
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 4.0 | HIGH 8.7 | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L | Citrix |
| CVSS 4.0 | HIGH 8.7 | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · secure@citrix.com (Secondary) |
European references
- ENISA EUVD · EUVD-2025-25868
- GCVE · GCVE-0-2025-8424
CERT-FR advisories
- CERTFR-2025-AVI-0730 — Multiples vulnérabilités dans Citrix NetScaler ADC et NetScaler Gateway · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| NetScaler · ADC | affected 14.1 < 47.48 ; affected 13.1 < 59.22 ; affected 13.1 FIPS and NDcPP < 37.241 ; affected 12.1 FIPS and NDcPP < 55.330 |
| NetScaler · Gateway | affected 14.1 < 47.48 ; affected 13.1 < 59.22 ; affected 13.1 FIPS and NDcPP < 37.241 ; affected 12.1 FIPS and NDcPP < 55.330 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |