CVE-2023-6548

State: Published
Severity: 5.5 Medium
Published: Jan 17, 2024
Updated: Oct 21, 2025
Reserved: Dec 6, 2023

Description

Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	Citrix

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

Product	Versions
NetScaler ADCCloud Software Group	14.1 to before 12.35Affected 13.1 to before 51.15Affected 13.0 to before 92.21Affected 13.1-FIPS to before 37.176Affected 12.1-FIPS to before 55.302Affected 12.1-NDcPP to before 55.302Affected
NetScaler GatewayCloud Software Group	14.1 to before 12.35Affected 13.1 to before 51.15Affected 13.0 to before 92.21Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.