CVE-2023-6548

Estado: AnalizadaAlta (8.8)⚠ Explotación activa

Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 8.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 3.19%
Percentil entre todas las CVEs puntuadas: 88
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CISA KEV — explotada activamente

Añadida al catálogo: 17/1/2024
Plazo de remediación: 24/1/2024
Uso conocido en ransomware: Unknown

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1210 Exploitation of Remote Serviceslateral movement85 %
Impacto principalT1059 Command and Scripting Interpreterexecution90 %
Impacto secundarioT1078 Valid Accountsstealth · persistence · privilege escalation · initial access70 %

CWE-94 (Code Injection) en interfaz de gestión accesible remotamente (AV:N) con autenticación de bajo privilegio permite ejecución remota de código. NetScaler expuesto en red accesible; impacto confirmado por RCE autenticado y potencial acceso a cuentas administrativas.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management Disable or Remove Feature or Program Application Developer Guidance Active Directory Configuration Vulnerability Scanning User Training

Tecnologías afectadas (2)

Citrix — Netscaler Application Delivery Controller Citrix — Netscaler Gateway

CWE

CWE-94
CWE-94

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2023-6548",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-6548",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-01-18T14:00:57.375485Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secure@citrix.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 2.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "secure@citrix.com",
      "affectedData": [
        {
          "vendor": "Cloud Software Group",
          "product": "NetScaler ADC",
          "versions": [
            {
              "status": "affected",
              "version": "14.1",
              "lessThan": "12.35",
              "versionType": "patch"
            },
            {
              "status": "affected",
              "version": "13.1",
              "lessThan": "51.15",
              "versionType": "patch"
            },
            {
              "status": "affected",
              "version": "13.0",
              "lessThan": "92.21",
              "versionType": "patch"
            },
            {
              "status": "affected",
              "version": "13.1-FIPS",
              "lessThan": "37.176",
              "versionType": "patch"
            },
            {
              "status": "affected",
              "version": "12.1-FIPS",
              "lessThan": "55.302",
              "versionType": "patch"
            },
            {
              "status": "affected",
              "version": "12.1-NDcPP",
              "lessThan": "55.302",
              "versionType": "patch"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Cloud Software Group",
          "product": "NetScaler Gateway",
          "versions": [
            {
              "status": "affected",
              "version": "14.1",
              "lessThan": "12.35",
              "versionType": "patch"
            },
            {
              "status": "affected",
              "version": "13.1",
              "lessThan": "51.15",
              "versionType": "patch"
            },
            {
              "status": "affected",
              "version": "13.0",
              "lessThan": "92.21",
              "versionType": "patch"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:citrix:netscaler_application_delivery_controller:14.1:*:*:*:-:*:*:*"
          ],
          "vendor": "citrix",
          "product": "netscaler_application_delivery_controller",
          "versions": [
            {
              "status": "affected",
              "version": "14.1",
              "lessThan": "14.1-12.35",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:citrix:netscaler_application_delivery_controller:13.1:*:*:*:-:*:*:*"
          ],
          "vendor": "citrix",
          "product": "netscaler_application_delivery_controller",
          "versions": [
            {
              "status": "affected",
              "version": "13.1",
              "lessThan": "13.1-51.15",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:citrix:netscaler_application_delivery_controller:13.0:*:*:*:-:*:*:*"
          ],
          "vendor": "citrix",
          "product": "netscaler_application_delivery_controller",
          "versions": [
            {
              "status": "affected",
              "version": "13.0",
              "lessThan": "13.0-92.21",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:citrix:netscaler_application_delivery_controller:13.1:*:*:*:fips:*:*:*"
          ],
          "vendor": "citrix",
          "product": "netscaler_application_delivery_controller",
          "versions": [
            {
              "status": "affected",
              "version": "13.1",
              "lessThan": "13.1-37.176",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:citrix:netscaler_application_delivery_controller:12.1:*:*:*:fips:*:*:*"
          ],
          "vendor": "citrix",
          "product": "netscaler_application_delivery_controller",
          "versions": [
            {
              "status": "affected",
              "version": "12.1",
              "lessThan": "12.1-55.302",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:citrix:netscaler_application_delivery_controller:12.1:*:*:*:ndcpp:*:*:*"
          ],
          "vendor": "citrix",
          "product": "netscaler_application_delivery_controller",
          "versions": [
            {
              "status": "affected",
              "version": "12.1",
              "lessThan": "12.1-55.302",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:citrix:netscaler_gateway:14.1:*:*:*:*:*:*:*"
          ],
          "vendor": "citrix",
          "product": "netscaler_gateway",
          "versions": [
            {
              "status": "affected",
              "version": "14.1",
              "lessThan": "14.1-12.35",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:citrix:netscaler_gateway:13.1:*:*:*:*:*:*:*"
          ],
          "vendor": "citrix",
          "product": "netscaler_gateway",
          "versions": [
            {
              "status": "affected",
              "version": "13.1",
              "lessThan": "13.1-51.15",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:citrix:netscaler_gateway:13.0:*:*:*:*:*:*:*"
          ],
          "vendor": "citrix",
          "product": "netscaler_gateway",
          "versions": [
            {
              "status": "affected",
              "version": "13.0",
              "lessThan": "13.0-92.21",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-01-17T20:15:50.627",
  "references": [
    {
      "url": "https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secure@citrix.com"
    },
    {
      "url": "https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-6548",
      "tags": [
        "US Government Resource"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secure@citrix.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface."
    },
    {
      "lang": "es",
      "value": "El control inadecuado de la generación de código (\"inyección de código\") en NetScaler ADC y NetScaler Gateway permite a un atacante con acceso a NSIP, CLIP o SNIP con interfaz de administración realizar una ejecución remota de código autenticado (con privilegios bajos) en Management Interface."
    }
  ],
  "lastModified": "2026-06-17T06:50:58.003",
  "cisaActionDue": "2024-01-24",
  "cisaExploitAdd": "2024-01-17",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E5672003-8E6B-4316-B5C9-FE436080ADD1",
              "versionEndExcluding": "12.1-55.302",
              "versionStartIncluding": "12.1"
            },
            {
              "criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D1A11ABD-4F45-4BA9-B30B-F1D8A612CC15",
              "versionEndExcluding": "12.1-55.302",
              "versionStartIncluding": "12.1"
            },
            {
              "criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FC0A5AAC-62DD-416A-A801-A7A95D5EF73C",
              "versionEndExcluding": "13.0-92.21",
              "versionStartIncluding": "13.0"
            },
            {
              "criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C8A6B95-8338-4EE7-A6EC-7D84AEDC4AF3",
              "versionEndExcluding": "13.1-37.176",
              "versionStartIncluding": "13.1"
            },
            {
              "criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3CF77D9D-FC89-493D-B97D-F9699D182F54",
              "versionEndExcluding": "13.1-51.15",
              "versionStartIncluding": "13.1"
            },
            {
              "criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "62CD82CF-9013-4E54-B175-19B804A351AA",
              "versionEndExcluding": "14.1-12.35",
              "versionStartIncluding": "14.1"
            },
            {
              "criteria": "cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "68E1F810-ABCD-40A7-A8C1-4E8727799C7C",
              "versionEndExcluding": "13.0-92.21",
              "versionStartIncluding": "13.0"
            },
            {
              "criteria": "cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E870C309-D5CD-4181-9DEB-4833DE2EAEB7",
              "versionEndExcluding": "13.1-51.15",
              "versionStartIncluding": "13.1"
            },
            {
              "criteria": "cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2836707F-A36F-479E-BFDC-CF55AEFC37EE",
              "versionEndExcluding": "14.1-12.35",
              "versionStartIncluding": "14.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@citrix.com",
  "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
  "cisaVulnerabilityName": "Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability"
}