CVE-2023-6548: Citrix NetScaler authenticated code injection via the management interface
The short version: CVE-2023-6548 lets an authenticated, low-privilege user inject code through the NetScaler management interface (NSIP, CLIP, or SNIP). It's in CISA's KEV catalog and was disclosed alongside an unauthenticated denial-of-service flaw (CVE-2023-6549) — but on its own it requires both a valid login and reachability to the management plane, which is precisely what you're supposed to keep off the internet. Patch it, and keep management interfaces private. Steady hands.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — real preconditions (authenticated + management-plane access) |
| CVSS v3.1 (NVD) | 8.8 — High · AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CVSS (Citrix, CNA) | 5.5 — Medium · AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| EPSS | ~3.2% · 86.7th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2024-01-24 |
| Known exploited? | Yes — KEV-listed (limited, targeted exploitation reported; typically requires management-plane access) |
| Vulnerability type | CWE-94 code injection → code execution, requiring authenticated access to the management interface |
| Requires authenticated session? | Yes — low-privilege authenticated access to NSIP/CLIP/SNIP |
| Affected | NetScaler ADC & Gateway: 14.1 < 14.1-12.35, 13.1 < 13.1-51.15, 13.0 < 13.0-92.21, 13.1-FIPS < 13.1-37.176, 12.1-FIPS/NDcPP < 12.1-55.302 (12.1 and 13.0 are EOL) |
| Fixed in | 14.1-12.35 · 13.1-51.15 · 13.0-92.21 · and the matching FIPS/NDcPP builds |
What you need to know
NetScaler exposes a management interface (the NSIP, cluster CLIP, or subnet SNIP addresses) used to administer the appliance. CVE-2023-6548 is a code-injection flaw reachable through that interface — but only by someone who is already authenticated at low privilege and can reach the management plane.
Two facts set the practical severity:
- It needs a login. This is not a pre-auth internet bug. An attacker has to have (or obtain) valid low-privilege credentials.
- It needs management-plane reachability. Citrix's own guidance — and standard practice — is that NSIP/management access should be on a segregated, non-internet-facing network.
That's why NVD's 8.8 and Citrix's 5.5 differ so much: NVD scores the raw network-code-execution mechanics; Citrix scores it as adjacent-network with the real preconditions in view. It's in KEV because it was exploited — but in targeted situations where those preconditions were met, and it was commonly paired with the unauthenticated DoS flaw disclosed at the same time (CVE-2023-6549).
How serious we see it
High — on paper NVD says High (8.8), and we land lower for a specific, defensible reason: the exploit needs both authentication and access to a management interface that shouldn't be exposed. Where a NetScaler is configured correctly — management plane segregated, no internet-facing admin — the practical reach of this bug is limited. It rises if the management interface is exposed or credentials are weak, which is exactly the misconfiguration to rule out. The reassuring part: specific builds, published fixes, quick to confirm.
Recommendations
Straight from Citrix's bulletin (CTX584986) and CISA:
- Patch now. Upgrade to 14.1-12.35 / 13.1-51.15 / 13.0-92.21 (or the matching FIPS/NDcPP builds). NetScaler 12.1 and 13.0 are End-of-Life — migrate off them.
- Get the management plane off the internet. Ensure NSIP/CLIP/SNIP management access is restricted to a segregated, trusted network — this is the single control that most reduces exposure.
- Enforce strong authentication. Kill weak/reused admin credentials; limit and monitor management logins.
- Hunt if the management interface was exposed. Review logs for unexpected administrative activity.
- Confirm your exposure first. Verify your build and whether the management interface is reachable from untrusted networks.
How BreachRisk sees it
BreachRisk works from the outside in. It discovers internet-facing NetScaler interfaces, fingerprints the build, and — crucially for this flaw — flags when a management interface is exposed to the internet, which is the condition that turns an authenticated, preconditioned bug into a live one. Exposure tied to KEV-listed vulnerabilities is surfaced near the top of your results.
The honest value here isn't crying "Critical" on a version match; it's telling you plainly whether the precondition that matters — an exposed management plane — is true for you, so you can prioritize accordingly.