Code Injection in Citrix products - CVE-2020-8194
Published: July 8, 2020 / Updated: July 15, 2020
Vulnerability identifier: #VU29586
CSH Severity: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber
CVE-ID: CVE-2020-8194
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Citrix Netscaler ADC
Citrix NetScaler Gateway
SD-WAN 5100 WANOP
SD-WAN 5000 WANOP
SD-WAN 4100 WANOP
SD-WAN 4000 WANOP
Citrix Netscaler ADC
Citrix NetScaler Gateway
SD-WAN 5100 WANOP
SD-WAN 5000 WANOP
SD-WAN 4100 WANOP
SD-WAN 4000 WANOP
Software vendor:
Citrix
Citrix
Description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation. A remote attacker can trick a victim to download a malicious binary from the NSIP and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install updates from vendor's website.