CVE-2025-6543: 
Citrix ADC VPX vulnerability analysis and mitigation

CVE-2025-6543 is a memory overflow (buffer overflow) vulnerability in Citrix NetScaler ADC and NetScaler Gateway that leads to unintended control flow and can enable remote code execution or Denial of Service. It affects devices configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Affected versions include NetScaler ADC and Gateway 13.1 before 13.1-59.19 (standard), 13.1 before 13.1-37.236 (FIPS/NDcPP), and 14.1 before 14.1-47.46. The vulnerability was publicly disclosed on June 25, 2025, but evidence indicates it was exploited as a zero-day beginning in mid-May 2025 — nearly two months before the patch was released. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.2 (Critical) (Citrix Advisory, CISA KEV).

The vulnerability is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), specifically a buffer overflow in the NetScaler ADC and Gateway components when configured in Gateway or AAA virtual server mode. An unauthenticated remote attacker can send specially crafted network requests to trigger the memory overflow, leading to unintended control flow — enabling arbitrary code execution or service disruption. No authentication or user interaction is required, and the attack vector is entirely network-based. The vulnerability has been nicknamed "CitrixBleed 2" by the security community, drawing parallels to the original CitrixBleed (CVE-2023-4966). Multiple public proof-of-concept exploits have been released on GitHub, and researcher Kevin Beaumont (DoublePulsar) published analysis confirming the vulnerability was exploited as a zero-day since May 2025 (Rapid7 ETR, DoublePulsar, Wiz Blog).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code on the affected NetScaler device, modify system data, or crash the NetScaler service entirely. Because NetScaler ADC and Gateway devices serve as critical network perimeter components — handling VPN, remote access, and authentication — compromise can provide attackers with a foothold into internal enterprise networks, enabling lateral movement, credential theft, and data exfiltration. Real-world exploitation in the Netherlands resulted in breaches of multiple critical-sector organizations, including a Dutch cancer screening laboratory where data of approximately 485,000 individuals was stolen. The Dutch NCSC confirmed that multiple threat actors, including groups attributed to Russia, exploited this vulnerability against critical infrastructure (BleepingComputer, The Hacker News, BankInfoSecurity).

1. Reconnaissance: Use Shodan, Censys, or Shadowserver data to identify internet-facing NetScaler ADC or Gateway instances running vulnerable versions (13.1 < 59.19 or 14.1 < 47.46) configured as VPN virtual servers, ICA Proxy, CVPN, RDP Proxy, or AAA virtual servers.
2. Fingerprint target: Confirm the device is configured in a vulnerable mode by probing publicly accessible NetScaler login or gateway endpoints (e.g., /vpn/index.html, /logon/LogonPoint/index.html).
3. Craft malicious request: Send a specially crafted unauthenticated HTTP/HTTPS request to the vulnerable NetScaler endpoint that triggers the buffer overflow condition in the memory handling code.
4. Trigger memory overflow: The malformed request causes the NetScaler process to overflow a memory buffer, leading to unintended control flow — either crashing the service (DoS) or redirecting execution to attacker-controlled code.
5. Achieve code execution: If the overflow is exploited for RCE, the attacker gains execution as the NetScaler service account, enabling deployment of web shells, backdoors, or credential harvesting tools on the appliance.
6. Lateral movement: Use the compromised NetScaler as a pivot point to access internal network resources, harvest VPN session tokens, or exfiltrate data from connected systems (Rapid7 ETR, DoublePulsar).

• Network: Unusual or malformed HTTP/HTTPS requests to NetScaler Gateway or VPN endpoints from unexpected source IPs; outbound connections from the NetScaler appliance to unknown external IPs; scanning activity targeting /vpn/, /logon/, or AAA virtual server endpoints.
• Logs: NetScaler access logs showing repeated requests with anomalous payloads or oversized headers to gateway endpoints; crash or core dump entries in NetScaler system logs; unexpected process restarts of the nsppe or related NetScaler daemons.
• File System: Presence of web shells or unexpected scripts in NetScaler web directories (e.g., /netscaler/, /var/nslog/); new or modified files in /flash/nsconfig/ or /var/ directories; unauthorized SSH keys added to the appliance.
• Process: Unexpected child processes spawned from NetScaler service processes; unusual outbound network connections initiated by NetScaler processes.
• Detection Scripts: The Dutch NCSC (NCSC-NL) released a public bash check script for live host detection at https://github.com/NCSC-NL/citrix-2025/tree/main/live-host-bash-check (NCSC-NL GitHub, Security Affairs).

Citrix released patches on June 25, 2025. Organizations should upgrade to the following fixed versions immediately:

• NetScaler ADC and Gateway 14.1: upgrade to 14.1-47.46 or later
• NetScaler ADC and Gateway 13.1: upgrade to 13.1-59.19 or later
• NetScaler ADC 13.1-FIPS: upgrade to 13.1-37.236 or later
• NetScaler ADC 13.1-NDcPP: upgrade to 13.1-37.236 or later

Note: NetScaler ADC and Gateway versions 12.1 and 13.0 are end-of-life and should be migrated to a supported version. CISA mandated remediation for federal agencies by July 21, 2025. If immediate patching is not possible, consider restricting access to NetScaler management interfaces and Gateway endpoints to trusted IP ranges. Citrix also noted that some customers experienced login issues after applying the auth bypass patch; a follow-up fix was released to address this (Citrix Advisory, CISA KEV, BleepingComputer).

Citrix/NetScaler issued an emergency security advisory and blog post urging immediate patching, describing the vulnerability as critical severity (NetScaler Blog). The Dutch NCSC (NCSC-NL) issued a public advisory confirming active exploitation against critical Dutch organizations and released a detection script on GitHub. Security researcher Kevin Beaumont (DoublePulsar) published a detailed analysis revealing that Citrix failed to disclose that the vulnerability had been exploited as a zero-day since May 2025, generating significant community criticism. Rapid7, Wiz, Tenable, ReliaQuest, and Arctic Wolf all published threat intelligence reports and FAQs. The vulnerability was widely dubbed "CitrixBleed 2" by the security community. Multiple national CERTs (CERT-EU, Canadian CCCS, Australian ACSC, New Zealand CERT, Belgian CCB) issued advisories. The Register, BleepingComputer, The Hacker News, and CyberScoop provided extensive coverage, and the story trended on security-focused social media platforms (DoublePulsar, The Register, BleepingComputer).