# CVE-2023-6548: Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability

> CVE-2023-6548: Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability. CVSS 5.5 (CVSS 3.1), in CISA KEV.

Canonical: https://rewindex.com/cve/CVE-2023-6548
Last updated: 2025-10-21T23:05:28Z

- Published: 2024-01-17 20:11 UTC · Updated: 2025-10-21 23:05 UTC · Assigner: Citrix
- CVSS: 5.5 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- EPSS: 3.2%, 88th percentile (scored 2026-10-25)
- CISA KEV: yes, added 2024-01-17, federal due date 2024-01-24, ransomware use: Unknown
- CWE: CWE-94

## Description

Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.

## CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

## Affected vendors and products

- citrix: netscaler\_application\_delivery\_controller
- citrix: netscaler\_gateway
- Cloud Software Group: NetScaler ADC
- Cloud Software Group: NetScaler Gateway

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2023-6548)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2023-6548)
- [https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549](https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2023-6548 · Markdown: https://rewindex.com/cve/CVE-2023-6548.md · JSON: https://rewindex.com/api/v1/cves/CVE-2023-6548 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:13:13.022Z