CVE-2023-6549: Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability

CVE-2023-6549 is a buffer overflow vulnerability in Citrix NetScaler ADC and NetScaler Gateway. When the product is configured as a Gateway (including VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server, the flaw can be abused to cause a denial-of-service condition. For organizations that rely on these appliances for remote access, authentication, or application delivery, an unmitigated instance can disrupt availability of critical services. Specifics of affected builds and exact attack preconditions must be confirmed against the vendor advisory.

How it works

The vulnerability is classified as CWE-119, improper restriction of operations within the bounds of a memory buffer. In products of this class, a buffer overflow occurs when input is written past the end of an allocated buffer, overwriting adjacent memory. An attacker who can reach the affected Gateway or AAA virtual server can send crafted traffic that triggers the overflow and results in a denial-of-service. Public detail is limited to the denial-of-service outcome described by CISA; no further exploit mechanics are provided here. Defenders should treat any unauthenticated or authenticated network path to the configured virtual servers as a potential attack surface and verify the precise conditions in the vendor advisory.

Am I affected? How to find it in your systems

Citrix NetScaler ADC and NetScaler Gateway appliances commonly sit at the network edge or in DMZ segments to terminate VPN, proxy ICA/RDP sessions, or enforce AAA. Inventory every NetScaler instance in your environment—physical, virtual, or cloud-hosted—and record its role and configuration. Check whether any virtual server is defined as a Gateway (VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server; those configurations are the ones called out as vulnerable. Confirm the exact software versions and build numbers against the vendor advisory, because only the advisory lists the fixed releases. Review appliance logs and monitoring for sudden restarts, crash dumps, or unexplained service interruptions on the Gateway or AAA listeners; such events may indicate attempted or successful exploitation of a buffer-overflow denial-of-service. Network flow data showing anomalous traffic volume or malformed packets directed at the management or data-plane ports of the appliance can also serve as an early indicator.

• Enumerate all NetScaler ADC and Gateway instances via configuration management or asset inventory tools.
• Inspect the running configuration for Gateway and AAA virtual servers.
• Compare installed builds to the fixed versions listed in the vendor advisory.
• Correlate appliance crash or high-availability failover events with external traffic patterns.

How to remediate

The primary remediation is to apply the vendor-supplied update that addresses CVE-2023-6549. Follow the installation and reboot guidance in the Citrix advisory exactly; do not assume that a generic firmware upgrade is sufficient. After patching, re-validate that Gateway and AAA virtual servers continue to function and that the vulnerability is no longer present. CISA’s required action is to apply mitigations per vendor instructions or to discontinue use of the product if mitigations are unavailable. Once the patch is in place, review and harden the remaining attack surface: restrict management access to trusted networks, enforce strong authentication on the AAA path, and ensure that only necessary virtual servers are enabled.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls. Segment the NetScaler appliances so that only required client networks can reach the Gateway and AAA listeners; block all other inbound traffic at the firewall. If a web application firewall or reverse-proxy layer sits in front of the appliance, enable virtual-patching rules that drop or rate-limit traffic patterns known to trigger buffer overflows in this product class—confirm rule efficacy against the vendor’s guidance. Where operationally feasible, temporarily disable unused Gateway features (for example, RDP Proxy or CVPN) to shrink the attack surface. Increase monitoring of appliance health metrics, syslog, and SNMP traps for crash or resource-exhaustion events, and ensure that high-availability failover is tested and ready. These measures lower risk but do not replace the patch.

If your data may have been exposed

Although the documented impact of CVE-2023-6549 is denial-of-service and known ransomware use is not documented, any actively targeted vulnerability on an edge appliance can be a precursor to broader compromise. If you observe evidence of exploitation or unexplained outages, treat the incident as a potential breach: isolate the affected systems, preserve logs, and begin forensic review. Separately, individuals whose credentials or personal data may have been involved can run a free exposure scan of their email addresses against known breach data sets to determine whether those addresses appear in prior incidents.