CVE-2025-6543

A CWE-119 class error (buffer overflow) occurs in components handling VPN traffic when the device is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server. Improper buffer boundary management allows unintended control flow, which can lead to both device destabilization and potential unauthorized code execution. The attack is possible remotely over the network without authentication, although it requires specific technical conditions to be met (AC:H, AT:P).

An attacker can cause denial of service (DoS) to the NetScaler device, and unintended control flow creates a risk of arbitrary code execution in the context of the network process. Consequences include unavailability of VPN services and potential compromise of data confidentiality and integrity.

Immediately apply patches available from the vendor in accordance with references published in Citrix article CTX694788 (https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694788). Until the patch is deployed, consider restricting access to VPN and AAA interfaces to trusted networks only.

Citrix NetScaler ADC and Citrix NetScaler Gateway configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Specific versions are indicated in vendor references (CTX694788).

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Citrix NetScaler ADC and Gateway contain a buffer overflow vulnerability leading to unintended control flow and Denial of Service. NetScaler must be configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.