Medium severity5.5CISA KEVNVD Advisory· Published Jan 17, 2024· Updated Jun 17, 2026

CVE-2023-6548

Description

Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Citrix Systems/Netscaler Application Delivery Controller3 versions
cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*+ 2 more
- cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*range: >=13.0,<13.0-92.21
- cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*range: >=12.1,<12.1-55.302
- cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*range: >=12.1,<12.1-55.302
Citrix Systems/Access Gateway
cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*
Range: >=13.0,<13.0-92.21
Citrix Systems/NetScaler ADCllm-fuzzy
Citrix Systems/NetScaler Gatewayllm-fuzzy
Cloud Software Group/NetScaler ADCv5
Range: 14.1
Cloud Software Group/Netscaler Gatewayv5
Range: 14.1

Patches

Vulnerability mechanics

References

support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549nvdVendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.003
exploit	0.000
kev	0.120
patch	0.000
ransomware	0.000