CVE-2025-7775

Estado: AnalizadaCrítica (9.2)⚠ Explotación activa

Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server

(OR)

NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with IPv6 services or servicegroups bound with IPv6 servers

(OR)

NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with DBS IPv6 services or servicegroups bound with IPv6 DBS servers

Leer descripción completaMostrar menos

(OR)

CR virtual server with type HDX

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Puntuación base: 9.2

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 20%
Percentil entre todas las CVEs puntuadas: 97
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CISA KEV — explotada activamente

Añadida al catálogo: 26/8/2025
Plazo de remediación: 28/8/2025
Uso conocido en ransomware: Unknown

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access90 %
Impacto principalT1059 Command and Scripting Interpreterexecution85 %
Impacto secundarioT1499.004 Application or System Exploitationimpact80 %

Memory overflow en aplicaciones expuestas (NetScaler ADC/Gateway) sin autenticación (PR:N), CVSS CRITICAL. Permite RCE (T1059) o DoS (T1499.004) según configuración afectada.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management Filter Network Traffic Vulnerability Scanning Restrict Web-Based Content Network Segmentation Limit Software Installation

Tecnologías afectadas (2)

Citrix — Netscaler Application Delivery Controller Citrix — Netscaler Gateway

CWE

CWE-119

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2025-7775",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-7775",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-08-27T03:55:14.429609Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "secure@citrix.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 9.2,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "LOW",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "LOW",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "LOW",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "secure@citrix.com",
      "affectedData": [
        {
          "vendor": "NetScaler",
          "product": "ADC",
          "versions": [
            {
              "status": "affected",
              "version": "14.1",
              "lessThan": "47.48",
              "versionType": "patch"
            },
            {
              "status": "affected",
              "version": "13.1",
              "lessThan": "59.22",
              "versionType": "patch"
            },
            {
              "status": "affected",
              "version": "13.1 FIPS and NDcPP",
              "lessThan": "37.241",
              "versionType": "patch"
            },
            {
              "status": "affected",
              "version": "12.1 FIPS and NDcPP",
              "lessThan": "55.330",
              "versionType": "patch"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "NetScaler",
          "product": "Gateway",
          "versions": [
            {
              "status": "affected",
              "version": "14.1",
              "lessThan": "47.48",
              "versionType": "patch"
            },
            {
              "status": "affected",
              "version": "13.1",
              "lessThan": "59.22",
              "versionType": "patch"
            },
            {
              "status": "affected",
              "version": "13.1 FIPS and NDcPP",
              "lessThan": "37.241",
              "versionType": "patch"
            },
            {
              "status": "affected",
              "version": "12.1 FIPS and NDcPP",
              "lessThan": "55.330",
              "versionType": "patch"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-08-26T13:15:32.870",
  "references": [
    {
      "url": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secure@citrix.com"
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-7775",
      "tags": [
        "US Government Resource"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secure@citrix.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server\n\n(OR)\n\nNetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with IPv6 services or servicegroups bound with IPv6 servers \n\n(OR)\n\nNetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with DBS IPv6 services or servicegroups bound with IPv6 DBS servers\n\n(OR)\n\nCR virtual server with type HDX"
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de desbordamiento de memoria que provoca ejecución remota de código o denegación de servicio en NetScaler ADC y NetScaler Gateway cuando NetScaler está configurado como Gateway (servidor virtual VPN, proxy ICA, CVPN, proxy RDP) o servidor virtual AAA (O) NetScaler ADC y NetScaler Gateway 13.1, 14.1, 13.1-FIPS y NDcPP: servidores virtuales LB de tipo (HTTP, SSL o HTTP_QUIC) vinculados con servicios IPv6 o grupos de servicios vinculados con servidores IPv6 (O) NetScaler ADC y NetScaler Gateway 13.1, 14.1, 13.1-FIPS y NDcPP: servidores virtuales LB de tipo (HTTP, SSL o HTTP_QUIC) vinculados con servicios IPv6 DBS o grupos de servicios vinculados con servidores DBS IPv6 (O) servidor virtual CR de tipo HDX"
    }
  ],
  "lastModified": "2026-06-17T10:05:38.060",
  "cisaActionDue": "2025-08-28",
  "cisaExploitAdd": "2025-08-26",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5920186A-2278-4C5E-A2EE-047C4F6FAACD",
              "versionEndExcluding": "12.1-55.330",
              "versionStartIncluding": "12.1"
            },
            {
              "criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E09EC98B-E057-4FF7-9B18-EF460A29B876",
              "versionEndExcluding": "12.1-55.330",
              "versionStartIncluding": "12.1"
            },
            {
              "criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0096548F-A846-4D80-A4C6-71389543630F",
              "versionEndExcluding": "13.1-37.241",
              "versionStartIncluding": "13.1"
            },
            {
              "criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F40E29F2-8013-41A8-91A5-848FE6365876",
              "versionEndExcluding": "13.1-37.241",
              "versionStartIncluding": "13.1"
            },
            {
              "criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C2009493-AAFD-4090-84BC-5217A860E42A",
              "versionEndExcluding": "13.1-59.22",
              "versionStartIncluding": "13.1"
            },
            {
              "criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3487EADF-F387-4DD4-B600-B1EBC416632E",
              "versionEndExcluding": "14.1-47.48",
              "versionStartIncluding": "14.1"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DBA34500-BFE6-4B33-A52B-326C4C2069B1",
              "versionEndExcluding": "13.1-59.22",
              "versionStartIncluding": "13.1"
            },
            {
              "criteria": "cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "004E06F6-0ABF-4414-B2A2-8834C1E6107D",
              "versionEndExcluding": "14.1-47.48",
              "versionStartIncluding": "14.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@citrix.com",
  "cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "cisaVulnerabilityName": "Citrix NetScaler Memory Overflow Vulnerability"
}