Unrated severityNVD Advisory· Published Aug 12, 2014· Updated Jun 16, 2026

CVE-2011-2593

Description

Integer overflow in the StartEpa method in the nsepacom ActiveX control (nsepa.exe) in Citrix Access Gateway Enterprise Edition Plug-in for Windows 9.x before 9.3-57.5 and 10.0 before 10.0-69.4 allows remote attackers to execute arbitrary code via a crafted Content-Length HTTP header, which triggers a heap-based buffer overflow.

Affected products

Citrix Systems/Access Gateway Plug In2 versions
cpe:2.3:a:citrix:access_gateway_plug-in:10.0:*:*:*:enterprise:windows:*:*+ 1 more
- cpe:2.3:a:citrix:access_gateway_plug-in:10.0:*:*:*:enterprise:windows:*:*
- cpe:2.3:a:citrix:access_gateway_plug-in:*:49-5:*:*:enterprise:windows:*:*range: <=9.3
Citrix Systems/Access Gateway Enterprise Edition Plug-in for Windowsllm-fuzzy
Range: <9.3-57.5 (9.x), <10.0-69.4 (10.0)

Patches

Vulnerability mechanics

References

support.citrix.com/article/CTX134303nvdPatchVendor Advisory
secunia.com/advisories/45299nvd
secunia.com/secunia_research/2012-26nvd
exchange.xforce.ibmcloud.com/vulnerabilities/77317nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000