CVE-2025-6543

Published Jun 25, 2025

Last updated 5 days ago

Exploit known CVSS critical 9.2

NetScaler ADC

NetScaler Gateway

Citrix

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-6543 is a memory overflow vulnerability found in Citrix NetScaler ADC and NetScaler Gateway. It affects appliances configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. The vulnerability stems from improper restriction of operations within the bounds of a memory buffer. Successful exploitation of CVE-2025-6543 could lead to unintended control flow and a denial-of-service (DoS) condition. Exploits targeting this vulnerability have been observed in the wild, prompting Citrix to release security updates.

Description: Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
Source: secure@citrix.com
NVD status: Analyzed
Products: netscaler_application_delivery_controller, netscaler_gateway

Risk scores

CVSS 4.0

Type: Secondary
Base score: 9.2
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: CRITICAL

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability
Exploit added on: Jun 30, 2025
Exploit action due: Jul 21, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

secure@citrix.com: CWE-119

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0F079648-790A-4D18-908D-25CA575C5B46",
            "versionEndExcluding": "13.1-37.236",
            "versionStartIncluding": "13.1"
          },
          {
            "criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CF89AD2E-8A0A-43A9-9EEB-83D595576775",
            "versionEndExcluding": "13.1-37.236",
            "versionStartIncluding": "13.1"
          },
          {
            "criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "355DCB05-54E3-4C13-A74A-B27CE3F10597",
            "versionEndExcluding": "13.1-59.19",
            "versionStartIncluding": "13.1"
          },
          {
            "criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4A26624D-7F3F-4FD7-AC50-C9BDCA656F7B",
            "versionEndExcluding": "14.1-47.46",
            "versionStartIncluding": "14.1"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "598029C6-734C-450C-A7EC-495C72819E88",
            "versionEndExcluding": "13.1-59.19",
            "versionStartIncluding": "13.1"
          },
          {
            "criteria": "cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D977C8AE-4B4E-474D-ABD6-F55F054E5B59",
            "versionEndExcluding": "14.1-47.46",
            "versionStartIncluding": "14.1"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.