EUVD-2025-18493
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3Description
Arbitrary file read in NetScaler Console and NetScaler SDX (SVM)
Analysis
CVE-2025-4365 is an arbitrary file read vulnerability affecting Citrix NetScaler Console and NetScaler SDX (SVM) that allows unauthenticated remote attackers to read sensitive files from affected systems. The vulnerability has a CVSS score of 7.5 (high severity) with a network-accessible attack vector requiring no authentication or user interaction. While specific KEV and EPSS data were not provided in the intelligence sources, the combination of high CVSS, unauthenticated access, and file disclosure capability indicates this requires prompt remediation.
Technical Context
This vulnerability falls under CWE-1284 (Improper Validation of Specified Quantity in Input), which typically involves insufficient validation of input boundaries or file path traversal controls. In the NetScaler Console and SDX (Standalone Virtual Machine) context, this likely affects the management API or HTTP request handling layer that processes file or path-based requests without proper sanitization. NetScaler products are Citrix's application delivery and security appliances that run on physical hardware (NetScaler SDX) or as virtual machines (NetScaler Console/SVM). The vulnerability enables attackers to bypass access controls on the file system through improperly validated requests, potentially exposing configuration files, credentials, certificates, or other sensitive data stored on these management appliances.
Affected Products
Citrix NetScaler Console (exact versions not specified in provided data, but likely recent versions). Citrix NetScaler SDX with SVM (Standalone Virtual Machine mode). CPE identifiers would typically be: cpe:2.3:a:citrix:netscaler_console:*:*:*:*:*:*:*:* and cpe:2.3:a:citrix:netscaler_sdx:*:*:*:*:*:*:*:* (specific version ranges require consultation of Citrix advisory). The vulnerability affects management/control plane components, so any deployment exposing the NetScaler management interface is at risk.
Remediation
1. Consult Citrix Security Advisory (CTX number not provided in available intelligence—verify via Citrix official channels). 2. Apply vendor-provided patches to affected NetScaler Console and SDX instances immediately. 3. Until patching is complete: (a) Restrict network access to NetScaler management interfaces (port 443, 80) to trusted administrative networks only, implementing network-level access controls (firewall rules, IP whitelisting); (b) Do not expose NetScaler management interfaces directly to the internet; (c) Monitor access logs for suspicious file read requests. 4. Verify patch deployment and confirm vulnerability remediation through Citrix's verification procedures. Contact Citrix support (support.citrix.com) or your account representative for patch availability and version-specific guidance, as patch timelines were not provided in the intelligence sources.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today