{"id":"CVE-2025-5777","kind":"vulnerability","aliases":["CVE-2025-5777"],"related":[],"title":"Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual…","description":"Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Citrix NetScaler ADC and Gateway contain an out-of-bounds read caused by insufficient input validation, triggered when the appliance runs as a Gateway (VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. An attacker can read memory beyond the intended buffer, which can leak session tokens and other sensitive data held in the appliance's memory.","severity":"critical","cvss":9.3,"epss":null,"exploited":true,"exploited_at":"2025-07-10T00:00:00+00:00","products":[{"name":"Citrix NetScaler ADC and Gateway","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"citrix netscaler application delivery controller","fixed":["12.1-55.328"],"affected":">= 12.1, < 12.1-55.328","ecosystem":"vendor"},{"name":"citrix netscaler application delivery controller","fixed":["13.1-37.235"],"affected":">= 13.1, < 13.1-37.235","ecosystem":"vendor"},{"name":"citrix netscaler application delivery controller","fixed":["13.1-58.32"],"affected":">= 13.1, < 13.1-58.32","ecosystem":"vendor"},{"name":"citrix netscaler application delivery controller","fixed":["14.1-43.56"],"affected":">= 14.1, < 14.1-43.56","ecosystem":"vendor"},{"name":"citrix netscaler gateway","fixed":["13.1-58.32"],"affected":">= 13.1, < 13.1-58.32","ecosystem":"vendor"},{"name":"citrix netscaler gateway","fixed":["14.1-43.56"],"affected":">= 14.1, < 14.1-43.56","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["citrix","exploited","infrastructure","netscaler","ransomware","self-hosted","vpn"],"not_affected_if":["default-config"],"how_to_check":"Check whether the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server; the sources do not give a command.","fix":"Apply the vendor mitigations or patched build from Citrix; the sources do not name the fixed version.","status":"open","published_at":"2025-06-17T13:15:21+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:46:46+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:46:46Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigations or patched build from Citrix; the sources do not name the fixed version.\nunknown","reach":"internet","summary":"Citrix NetScaler ADC and Gateway contain an out-of-bounds read caused by insufficient input validation, triggered when the appliance runs as a Gateway (VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. An attacker can read memory beyond the intended buffer, which can leak session tokens and other sensitive data held in the appliance's memory.","category":"infrastructure","who_cares":["citrix","netscaler","self-hosted","vpn"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads sensitive appliance memory, possibly leaking session tokens or credentials.","analyst_note":"Exploited in the wild and listed in CISA KEV with ransomware tag; find the Citrix advisory for affected and fixed versions and exact mitigation steps.","how_to_check":"Check whether the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server; the sources do not give a command.\nunknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000505,"input_tokens":2625,"output_tokens":485,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':180C '-2025':19A,22A '-5777':20A,23A '22':179C 'aaa':96B,165C 'action':170C 'adc':26A,66B,125C 'and':27A 'appli':171C 'applianc':84B,120B 'applic':177C 'application':31A,36A,41A,46A 'attack':100B 'beyond':104B 'bod':178C 'bound':74B,133C 'buffer':107B 'caus':76B 'cisa':168C 'citrix':24A,29A,34A,39A,44A,49A,52A,55B,64B,123C 'cloud':183C 'configur':12A,152C 'contain':69B,128C 'controller':33A,38A,43A,48A 'cve':18A,21A 'cvpn':92B,161C 'data':116B 'delivery':32A,37A,42A,47A 'discontinu':186C 'due':136C 'exploit':56B 'follow':176C 'gateway':15A,28A,51A,54A,68B,88B,127C,155C 'guidanc':181C 'held':117B 'host':62B 'ica':90B,159C 'infrastructur':57B 'input':2A,79B,139C 'instruct':175C 'insuffici':1A,78B,138C 'intend':106B 'lead':4A,144C 'leak':110B 'memori':6A,103B,122B,146C 'mitig':172C,192C 'netscal':10A,58B,65B,124C,150C 'netscaler':25A,30A,35A,40A,45A,50A,53A 'out-of-bound':71B,130C 'overread':7A,147C 'per':173C 'product':190C 'proxi':91B,94B,160C,163C 'ransomwar':59B 'rdp':93B,162C 'read':75B,102B,134C 'requir':169C 'run':85B 'self':61B 'self-host':60B 'sensit':115B 'server':98B,158C,167C 'servic':184C 'session':111B 'token':112B 'trigger':81B 'unavail':194C 'use':187C 'valid':3A,80B,140C 'vendor':174C 'virtual':17A,97B,157C,166C 'vpn':16A,63B,89B,156C 'vulner':135C,142C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-06-17T13:15:21+00:00","kev":{"dateAdded":"2025-07-10","dueDate":"2025-07-11","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"secure@citrix.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-5777","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-5777","severity":null,"published_at":"2025-07-10T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:04+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-5777","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5777","severity":null,"published_at":"2025-06-17T13:15:21+00:00","modified_at":"2026-10-08T10:35:53+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}