Citrix NetScaler ADC and Gateway memory overflow enables remote code execution or denial of service

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service

• Citrix NetScaler ADC and Citrix NetScaler Gateway, 14.1 branch: affected before 14.1-73.37. The vendor identifies 14.1-73.37 and later releases of this branch as the update baseline.
• Citrix NetScaler ADC and Citrix NetScaler Gateway, 13.1 branch: affected before 13.1-64.23. The vendor identifies 13.1-64.23 and later releases of 13.1 as the update baseline.
• Citrix NetScaler ADC 14.1-FIPS: affected before 14.1-73.37 FIPS. The vendor identifies 14.1-73.37 FIPS and later releases of 14.1-FIPS as the update baseline.
• Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP: the normalized record identifies versions before 13.1.37.279 as affected; the vendor bulletin identifies 13.1.37.279 and later releases of 13.1-FIPS and 13.1-NDcPP as the update baseline.
• The bulletin applies to customer-managed NetScaler deployments. Cloud Software Group states that Citrix-managed cloud services and Citrix-managed Adaptive Authentication are updated separately.

Citrix NetScaler ADC and Citrix NetScaler Gateway contain a memory overflow in DTLS processing, classified as CWE-119, Improper Restriction of Operations within the Bounds of a Memory Buffer. The precondition is that DTLS is enabled on the appliance or virtual server. On NetScaler Gateway, DTLS is enabled by default on a VPN vServer unless it is explicitly disabled; other virtual servers meet the stated condition when configured with type DTLS. The attacker can reach the service over the network without authentication or user interaction, while the supplied assessment identifies high attack complexity. The resulting impact can be remote code execution or denial of service. The advisory does not disclose the exact function, processing path, packet structure, or malicious input that causes the overflow, so the precise trigger remains unknown from the available evidence.

The vulnerability is remotely reachable over the network when the DTLS precondition is met. The normalized record identifies no required privileges and no user interaction, but also identifies high attack complexity. Citrix states that exploitation of the vulnerability has been observed on unmitigated NetScaler deployments. The normalized record marks the vulnerability as known exploited and as having a public exploit. The available evidence does not identify an exploit name, payload, campaign, victim, or specific indicator of compromise.

The flaw allows a remote attacker to affect DTLS processing on a vulnerable appliance. The confirmed outcomes are remote code execution or denial of service. If remote code execution succeeds, control of the appliance and resulting effects on the confidentiality, integrity, or availability of traffic and services handled by it are possible, but the available evidence does not describe a specific exploit chain. If exploitation only causes a fault or process failure, VPN, gateway, or dependent network services may be disrupted. DTLS is a material limitation: an appliance that merely has the product installed but does not meet the configuration precondition is not established as affected by this specific flaw.

• Service disruption: Exploitation can cause a NetScaler ADC or NetScaler Gateway to stop providing service, affecting remote access, load balancing, or dependent network services.
• Appliance control risk: If remote code execution is achieved, an attacker may control the affected network appliance, which could expose or alter traffic and services handled by it.
• Priority scope: Customer-managed appliances that are network-reachable and have DTLS enabled require priority review. Secure Private Access Hybrid deployments using NetScaler instances are also within the scope identified by the vendor.
• Incident response: Because exploitation has been observed, organizations should combine patching with review for compromise on unmitigated instances. The available evidence does not confirm any specific breach.

1. Update immediately: Upgrade Citrix NetScaler ADC and Citrix NetScaler Gateway to 14.1-73.37 or a later release of the 14.1 branch, or to 13.1-64.23 or a later release of the 13.1 branch.
2. For Citrix NetScaler ADC 14.1-FIPS, upgrade to 14.1-73.37 FIPS or a later release of 14.1-FIPS.
3. For Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP, upgrade to 13.1.37.279 or a later release of the applicable branch.
4. Before and during the update, inventory VPN vServers and other virtual servers of type DTLS. If immediate updating is not possible, assess whether DTLS can be disabled on endpoints that do not require it; on VPN vServers, the configuration must explicitly disable DTLS. This removes the stated precondition but is not a replacement for patching.
5. Because Citrix has reported observed exploitation, perform forensic triage on unpatched, network-reachable appliances that meet the DTLS condition. If the update or an appropriate mitigation cannot be applied, assess isolation or discontinuation of the affected instance under the organization’s risk process.

1. Inventory all customer-managed Citrix NetScaler ADC and Citrix NetScaler Gateway appliances, then compare their versions and release branches with the boundaries in affected_summary.
2. Inspect the configuration for virtual servers with DTLS enabled. On NetScaler Gateway, treat DTLS as enabled when a VPN vServer does not explicitly disable it.
3. Search for the configuration patterns identified by the advisory, including add vpn vserver vpn1 SSL 10.0.0.0 443 -Listenpolicy NONE, add vpn vserver vs1 DTLS 10.11.1.1 443, and add lb vserver vd_dtls DTLS 10.146.111.74 443 -persistenceType NONE -cltTimeout 120.
4. Confirm whether affected VPN vServers contain -dtls OFF. This removes the stated precondition, but does not replace patching.
5. Prioritize review and forensic triage of unpatched, network-reachable appliances that meet the DTLS condition because the vendor has reported observed exploitation.
6. Review network and appliance telemetry for anomalous activity as a precaution. The reviewed advisory does not provide a CVE-specific IOC, and the absence of log evidence does not establish that an appliance is safe.