{"id":"CVE-2025-6543","kind":"vulnerability","aliases":["CVE-2025-6543"],"related":[],"title":"Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and…","description":"Citrix NetScaler ADC and Gateway contain a buffer overflow vulnerability leading to unintended control flow and Denial of Service. NetScaler must be configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"A buffer overflow in Citrix NetScaler ADC and Gateway can be triggered to redirect control flow or crash the appliance. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2025-06-30T00:00:00+00:00","products":[{"name":"Citrix NetScaler ADC and Gateway","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"citrix netscaler application delivery controller","fixed":["13.1-37.236"],"affected":">= 13.1, < 13.1-37.236","ecosystem":"vendor"},{"name":"citrix netscaler application delivery controller","fixed":["13.1-59.19"],"affected":">= 13.1, < 13.1-59.19","ecosystem":"vendor"},{"name":"citrix netscaler application delivery controller","fixed":["14.1-47.46"],"affected":">= 14.1, < 14.1-47.46","ecosystem":"vendor"},{"name":"citrix netscaler gateway","fixed":["13.1-59.19"],"affected":">= 13.1, < 13.1-59.19","ecosystem":"vendor"},{"name":"citrix netscaler gateway","fixed":["14.1-47.46"],"affected":">= 14.1, < 14.1-47.46","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["citrix","exploited","gateway","infrastructure","netscaler","vpn"],"not_affected_if":["not-gateway-or-aaa-config"],"how_to_check":"Check whether NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server; the sources do not give a command.","fix":"Apply the mitigations and fixed build from Citrix's vendor advisory; the sources do not name the fixed version.\nIf no mitigation is available, discontinue use of the product per CISA guidance.","status":"open","published_at":"2025-06-25T13:15:27+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:46:52+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:46:52Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations and fixed build from Citrix's vendor advisory; the sources do not name the fixed version.\nIf no mitigation is available, discontinue use of the product per CISA guidance.","reach":"internet","summary":"A buffer overflow in Citrix NetScaler ADC and Gateway can be triggered to redirect control flow or crash the appliance. CISA lists it as actively exploited in the wild.","category":"infrastructure","who_cares":["citrix","netscaler","gateway","vpn"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker can crash the appliance or run code via overflow, reaching the internet-facing gateway.","analyst_note":"Find the Citrix advisory for CVE-2025-6543 to get the affected and fixed versions and the exact mitigation steps; the CISA KEV entry does not list them.","how_to_check":"Check whether NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server; the sources do not give a command.\nunknown","needs_analyst":true,"not_affected_if":["not-gateway-or-aaa-config"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000487,"input_tokens":2606,"output_tokens":453,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':132C '-2025':17A,20A '-6543':18A,21A '22':131C 'aaa':117C 'action':122C 'activ':78B 'adc':15A,24A,60B,85C 'and':25A 'appli':123C 'applianc':73B 'applic':129C 'application':29A,34A,39A 'bod':130C 'buffer':55B,90C 'cisa':74B,120C 'citrix':22A,27A,32A,37A,42A,45A,48B,58B,83C 'cloud':135C 'configur':105C 'contain':88C 'control':7A,68B,96C 'controller':31A,36A,41A 'crash':71B 'cve':16A,19A 'cvpn':113C 'delivery':30A,35A,40A 'denial':10A,99C 'discontinu':138C 'exploit':49B,79B 'flow':8A,69B,97C 'follow':128C 'gateway':26A,44A,47A,50B,62B,87C,107C 'guidanc':133C 'ica':111C 'infrastructur':51B 'instruct':127C 'lead':4A,93C 'list':75B 'memori':1A 'mitig':124C,144C 'must':103C 'netscal':14A,52B,59B,84C,102C 'netscaler':23A,28A,33A,38A,43A,46A 'overflow':2A,56B,91C 'per':125C 'product':142C 'proxi':112C,115C 'rdp':114C 'redirect':67B 'requir':121C 'server':110C,119C 'servic':12A,101C,136C 'trigger':65B 'unavail':146C 'unintend':6A,95C 'use':139C 'vendor':126C 'virtual':109C,118C 'vpn':53B,108C 'vulner':3A,92C 'wild':82B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-06-25T13:15:27+00:00","kev":{"dateAdded":"2025-06-30","dueDate":"2025-07-21","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"secure@citrix.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-6543","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-6543","severity":null,"published_at":"2025-06-30T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T20:35:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-6543","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6543","severity":null,"published_at":"2025-06-25T13:15:27+00:00","modified_at":"2026-06-17T10:02:07+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}