CVE-2019-12990
published 2019-07-16CVE-2019-12990: Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow Directory Traversal.
PriorityP186critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
39.34%
98.4th percentile
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow Directory Traversal.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| citrix | citrix_sd-wan | — | — |
| citrix | netscaler_adc_gateway | — | — |
| citrix | netscaler_sd-wan | >= 10.0 < 10.0.8 | 10.0.8 |
| citrix | sd-wan | — | — |
| citrix | sd-wan | >= 10.2 < 10.2.3 | 10.2.3 |
| citrix | xenserver | — | — |
Detection & IOCsextracted from sources · hover to see the quote
urlPOST /Collector/appliancesettings/applianceSettingsFileTransfer HTTP/1.1
path/home/talariuser/www/app/webroot/files/
commandfilename=../../../../../../home/talariuser/www/app/webroot/files/{{randstr}}&filedata=
urlGET /talari/app/files/
otherhttp.title:"Citrix SD-WAN"
- →Detect exploitation attempts by monitoring POST requests to /Collector/appliancesettings/applianceSettingsFileTransfer with directory traversal sequences (e.g., ../../) in the 'filename' parameter.
- →Monitor for file creation under /home/talariuser/www/app/webroot/files/ by the www-data user, especially PHP files, which may indicate successful exploitation.
- →Detect follow-up GET requests to /talari/app/files/ after a suspicious POST to applianceSettingsFileTransfer, which may indicate an attacker verifying or executing a dropped webshell.
- →Traffic is routed through the Collector controller; monitor for unauthenticated access to the /Collector/ path on Citrix SD-WAN Center instances.
- →Use Shodan/FOFA queries to identify exposed Citrix SD-WAN Center instances: http.title:"Citrix SD-WAN" or title="citrix sd-wan".
- ·The vulnerable endpoint /Collector/appliancesettings/applianceSettingsFileTransfer is exploitable without authentication (unauth), making this a critical unauthenticated RCE vector.
- ·The vulnerability affects Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8; detections should be scoped to these versions. ↗
- ·The Content-Type for the exploit POST is application/x-www-form-urlencoded; WAF/IDS rules should inspect this content type for traversal sequences in the filename parameter.
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-82hx-pvjj-2m99: Citrix SD-WAN 10
ghsa_unreviewed·2022-05-24
CVE-2019-12990 [CRITICAL] CWE-22 GHSA-82hx-pvjj-2m99: Citrix SD-WAN 10
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow Directory Traversal.
VulnCheck
Citrix SD-WAN and NetScaler Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
vulncheck·2019·CVSS 9.8
CVE-2019-12990 [CRITICAL] Citrix SD-WAN and NetScaler Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Citrix SD-WAN and NetScaler Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow Directory Traversal.
Affected: Citrix SD-WAN and NetScaler
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-26&host_type=src&vulnerability=cve-2019-12990; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-30&host_type=src&vulnerability=cve-2019-12990; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-02&host_type=s
Citrix
CVE-2019-12990: Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow Directory Traversal.
vendor_citrix·2019-07-16·CVSS 9.8
CVE-2019-12990 [CRITICAL] CWE-22 CVE-2019-12990: Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow Directory Traversal.
CVE-2019-12990: Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow Directory Traversal.
Citrix
Citrix SD-WAN Multiple Security Updates
vendor_citrix·CVSS 9.8
CVE-2019-12985 [CRITICAL] Citrix SD-WAN Multiple Security Updates
Citrix SD-WAN Multiple Security Updates
of Problem Multiple vulnerabilities have been identified in the management console of the Citrix SD-WAN Center and NetScaler SD-WAN Center. Multiple Vulnerabilities have also been identified on the Citrix SD-WAN Appliance and NetScaler SD-WAN Appliance. Collectively, these vulnerabilities could result in an unauthenticated attacker executing commands as root against the SD-WAN Center management console, or potentially be used to gain root privileges on the SD-WAN appliance. The vulnerabilities have been assigned the following CVE numbers. CVE-2019-12985 – Unauthenticated Command Injection in Citrix SD-WAN Center 10.2.x before 10.2.3 and NetScaler SD-WAN Center 10.0.x before 10.0.8. CVE-2019-12986 – Unauthenticated Command Injection in Citrix SD-WAN
No detection rules found.
Nuclei
Citrix SD-WAN Center - Local File Inclusion
nuclei·CVSS 9.8
CVE-2019-12990 [CRITICAL] Citrix SD-WAN Center - Local File Inclusion
Citrix SD-WAN Center - Local File Inclusion
Citrix SD-WAN Center is susceptible to local file inclusion via the applianceSettingsFileTransfer function in ApplianceSettingsController. The function does not sufficiently validate or sanitize HTTP request parameter values used to construct a file system path. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted value for filename, filedata, and workspace_id, therefore being able to write files to locations writable by the www-data user and/or to write a crafted PHP file to /home/talariuser/www/app/webroot/files/ to execute arbitrary PHP code.
Template:
id: CVE-2019-12990
info:
name: Citrix SD-WAN Center - Local File Inclusion
author: gy741
severity: critical
description: |
C
Tenable
Multiple Vulnerabilities Found in Citrix SD-WAN Center and SD-WAN Appliances
blogs_tenable·2019-07-11
Multiple Vulnerabilities Found in Citrix SD-WAN Center and SD-WAN Appliances
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
Citrix SD-WAN Center Multiple Vulnerabilities
blogs_tenable·2019-07-02
Citrix SD-WAN Center Multiple Vulnerabilities
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Greynoiseio
NoiseLetter March 2026
blogs_greynoiseio
NoiseLetter March 2026
Events, events… and yes, even more events. 🌍 GreyNoise has been on the move. March kept us busy with stops at eCrimes in London and SecIT in Hanover—but we’re just getting started. Over the next few months, we’ll be hitting the road for CrowdStrike CrowdTours across eight cities, heading to Glasgow to speak and sponsor CyberUK, and making our way to Tampa for H-ISAC. If you’ll be at any of these (or nearby), we’d love to connect.
And while we’ve been racking up miles, we haven’t slowed down on the research front. We’ve just released some exciting new findings—with even more coming in the next few weeks—so keep an eye out.
Thanks, as always, for being part of the GreyNoise community.
Featured
About this new report
Every enterprise firewall processes traffic from residential IP space. T
http://www.securityfocus.com/bid/109133https://support.citrix.com/search?searchQuery=%2A&lang=en&sort=relevance&prod=&pver=&ct=Security+Bulletinhttps://www.tenable.com/security/research/tra-2019-31http://www.securityfocus.com/bid/109133https://support.citrix.com/search?searchQuery=%2A&lang=en&sort=relevance&prod=&pver=&ct=Security+Bulletinhttps://www.tenable.com/security/research/tra-2019-31
2019-07-16
Published
Exploited in the wild