by Kastro
Paper/Archive/CVE-2025-6543

CVE-2025-6543

NetScaler ADC — Memory overflow vulnerability leading to unintended control flow and Denial of Service

KEV · due 21 JulEPSS 10%public exploitSSVC actCVSS 9.2
critical.is priorityof 100
97
CVSS 9.2 (CNA)9.2 / 10 × 3027.6In CISA KEV+3030.0EPSS percentile 95.7.957 × 2019.1Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

Affected

ProductAffectedFixed inSource
ADC14.1 – < 47.4647.46CNA
ADC13.1 – < 59.1959.19CNA
ADC13.1 FIPS and NDcPP – < 37.23637.236CNA
Gateway14.1 – < 47.4647.46CNA
Gateway13.1 – < 59.1959.19CNA
Gateway13.1 FIPS and NDcPP – < 37.23637.236CNA

Scores by source

Citrix (CNA)9.2CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
CISA ADPSSVCExploitation: active · Automatable: no · Technical impact: total

References

refsupport.citrix.com/support-home/kbsearch/article?articleNumber=CTX694788refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6543kevcisa.gov/known-exploited-vulnerabilities-catalog