CVE-2023-6548: Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability

CVE-2023-6548 is a code injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway. It allows an authenticated attacker who can reach the management interface via NSIP, CLIP, or SNIP to achieve remote code execution. For IT and security teams, this matters because these appliances often sit at the network edge or handle authentication and traffic for critical applications; successful exploitation can give an attacker a foothold on a high-value system that controls or inspects traffic.

Public detail is limited to the CISA description and the CWE classification; exact affected versions, attack prerequisites beyond authentication and management-interface access, and any exploit mechanics must be confirmed against the vendor advisory.

How it works

The vulnerability is classified as CWE-94 (Improper Control of Generation of Code, or Code Injection). In products of this class, an attacker who is already authenticated and can interact with the management plane supplies input that the device treats as executable code rather than data. On NetScaler ADC and Gateway, that interaction is limited to the management interface reachable via the NSIP, CLIP, or SNIP addresses. Once the injected code runs, the attacker gains remote code execution with the privileges of the process handling the management request. No further exploit details are provided in the available facts; defenders should treat any authenticated management-plane access as a potential vector and verify the precise conditions in the vendor advisory.

Am I affected? How to find it in your systems

Citrix NetScaler ADC and NetScaler Gateway appliances are commonly deployed as load balancers, reverse proxies, VPN gateways, or application delivery controllers. They appear in data centers, cloud environments, and hybrid networks, often with management interfaces on dedicated networks or VLANs.

• Inventory all NetScaler ADC and Gateway instances by querying configuration management databases, network discovery tools, or Citrix management consoles for devices advertising NSIP, CLIP, or SNIP addresses.
• Confirm the software version and build against the list of fixed releases in the vendor advisory; do not rely on version numbers not published by Citrix.
• Identify whether the management interface is reachable from untrusted or broad internal networks; any exposure of NSIP, CLIP, or SNIP increases risk.
• Review authentication logs and management-session records for unexpected successful logins, unusual command sequences, or new administrative accounts. Look for process or shell activity originating from the management plane that does not match normal administrative patterns. Telemetry from network sensors watching management subnets can also surface anomalous traffic to those interfaces.

If the appliance is no longer supported or the advisory indicates no fix is available, treat it as affected until it is decommissioned.

How to remediate

The primary action is to apply the vendor-supplied update that addresses CVE-2023-6548. Follow the installation and reboot guidance in the Citrix advisory exactly; confirm the post-update version matches a fixed release.

• After patching, re-verify that management interfaces remain restricted and that authentication is still enforced.
• Harden the management plane by limiting access to NSIP, CLIP, and SNIP to a small set of jump hosts or management networks, preferably with multi-factor authentication.
• Disable unused management features and protocols if the vendor documentation permits it.
• If mitigations described by the vendor cannot be applied, CISA guidance is to discontinue use of the product.

Document the change window, validation steps, and any residual risk for audit purposes.

If you can't patch immediately

Until the vendor update can be installed, reduce the attack surface with compensating controls:

• Segment the management network so that NSIP, CLIP, and SNIP addresses are reachable only from tightly controlled administrative hosts; block all other sources at the firewall or ACL layer.
• Place a web application firewall or reverse-proxy filter in front of any management web interface and apply virtual-patching rules that reject unexpected input patterns associated with code-injection attempts; tune these rules carefully to avoid breaking legitimate administration.
• Temporarily disable remote management features if operationally feasible, forcing all configuration changes through console or out-of-band access.
• Increase monitoring and alerting on authentication events, configuration changes, and process creation on the appliance; forward logs to a SIEM and create high-priority alerts for anomalies.
• Ensure that any accounts with management privileges use strong, unique credentials and multi-factor authentication where supported.

These measures lower risk but do not eliminate it; schedule the permanent patch as soon as possible.

If your data may have been exposed

Actively exploited vulnerabilities of this class can lead to full compromise of the appliance and subsequent lateral movement or data theft. Known ransomware use is not documented for this CVE. If you suspect exploitation, isolate the device, preserve forensic evidence, and follow your incident-response plan. As a quick check for personal or organizational email addresses that may appear in known breach data, you can run a free exposure scan.