⚠ Actively exploited
Added to CISA KEV on 2021-11-03. Federal agencies required to patch by 2022-05-03. Required action: Apply updates per vendor instructions..

CVE-2020-8193 — Improper Access Control in Citrix Application Delivery Controller Firmware

CWE-284 — Improper Access ControlCWE-287 — Improper AuthenticationCWE-862 — Missing Authorization24 documents12 sources
Severity
6.5MEDIUMNVD
EPSS
94.4%
top 0.03%
CISA KEV
KEV
Added 2021-11-03
Due 2022-05-03
Exploit
Exploited in wild
Active exploitation observed
Affected products
12
Citrix Application Delivery Controller FirmwareCitrix Gateway FirmwareCitrix Netscaler Gateway Firmware+9 more
Timeline
PublishedJul 10
KEV addedNov 3
KEV dueMay 3
Latest updateMay 24
CISA Required Action: Apply updates per vendor instructions.

Description

Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows unauthenticated access to certain URL endpoints.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitability: 3.9 | Impact: 2.5

Affected Packages12 packages

▶NVDcitrix/gateway_firmware13.0 — 13.0-58.30
▶NVDcitrix/netscaler_gateway_firmware10.5 — 10.5-70.18+3

🔴Vulnerability Details

2
GHSA
GHSA-wrxp-682m-vm9p: Improper access control in Citrix ADC and Citrix Gateway versions before 13↗2022-05-24
▶
VulnCheck
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability↗2020
▶

💥Exploits & PoCs

2
Exploit-DB
Citrix ADC NetScaler - Local File Inclusion (Metasploit)↗2020-11-13
▶
Nuclei
Citrix - Local File Inclusion
▶

🔍Detection Rules

2
Suricata
ET EXPLOIT Possible Citrix Authentication Bypass Attempt Inbound (CVE-2020-8193)↗2020-10-21
▶
Suricata
ET EXPLOIT Possible Citrix Information Disclosure Attempt Inbound (CVE-2020-8195)↗2020-10-21
▶

📋Vendor Advisories

3
CISA
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability↗2021-11-03
▶
Citrix
Citrix Application Delivery Controller, Citrix Gateway, and Citrix SD-WAN WANOP appliance Security Update↗2020-08-17
▶
Citrix
CVE-2020-8193: Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWA↗2020-07-10
▶

🕵️Threat Intelligence

14
Tenable
Hold the Door: Why Organizations Need to Prioritize Patching SSL VPNs↗2021-08-25
▶
Tenable
One Year Later: What Can We Learn from Zerologon?↗2021-08-11
▶
Trendmicro
Manage Zero Day Exploits (ZDI) with Trend Micro Solutions↗2021-04-28
▶
Trendmicro
Manage Zero Day Exploits (ZDI) with Trend Micro Solutions↗2021-04-28
▶
Trendmicro
Manage Zero Day Exploits (ZDI) with Trend Micro Solutions↗2021-04-28
▶