Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability (CVE-2023-6548)

An attacker, with a low-privilege account, can achieve partial data exposure, partial data tampering, partial service disruption. Federal agencies are required to remediate by 2024-01-24 under CISA BOD 22-01.

This is a Code Injection (CWE-94) vulnerability in Citrix NetScaler ADC and NetScaler Gateway. Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface. Exploitation requires adjacent_network access, low attack complexity, a low-privilege authenticated account, and no user interaction required.

Probably yes if any of these apply:

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2024-01-17 based on evidence of active exploitation in the wild. Federal agencies required to remediate by 2024-01-24.