Citrix · NetScaler ADC and NetScaler Gateway
Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that affects deployments configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. Through this flaw, an attacker with network access can cause sensitive information to be disclosed, requiring no authentication, no privileges, and no user interaction.
Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
First seen exploited 7 days after disclosure. Public exploit code (PoC-in-GitHub) appeared 14 days after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
This is a buffer overflow vulnerability that results in unauthorized disclosure of memory, including session tokens.
This is a buffer overflow vulnerability that results in unauthorized disclosure of memory, including session tokens.
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2023-4966 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Apart from CVE-2023-46805 and CVE-2024-21887, Mandiant has previously observed UNC5221 conducting zero day exploitation of CVE-2023-4966, impacting NetScaler ADC and NetScaler Gateway appliances.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.