EUVD-2025-18497
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
5Tags
Description
Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
Analysis
Citrix NetScaler ADC and Gateway contain an input validation vulnerability (CVE-2025-5777, CVSS 7.5) leading to memory overread when configured as VPN or AAA virtual server. KEV-listed with EPSS 69.8% and public PoC, this vulnerability enables remote unauthenticated attackers to read sensitive data from the appliance's memory, potentially exposing session tokens, credentials, and encryption keys — similar to the Heartbleed class of memory disclosure bugs.
Technical Context
The vulnerability is a Heartbleed-style memory overread in the VPN/AAA components of NetScaler. Insufficient validation of input length fields allows an attacker to read beyond buffer boundaries into adjacent memory. This memory may contain: active session tokens (enabling session hijacking), plaintext credentials from recent VPN authentications, TLS private keys (enabling MITM decryption), and other sensitive data stored in the appliance's memory.
Affected Products
['Citrix NetScaler ADC (when configured as Gateway VPN, ICA Proxy, CVPN, RDP Proxy)', 'Citrix NetScaler Gateway (when configured as Gateway or AAA virtual server)']
Remediation
Apply Citrix security update immediately. After patching: invalidate all active VPN sessions and force re-authentication. Rotate TLS certificates and private keys (they may have been exposed). Review VPN access logs for session hijacking indicators. Audit for unauthorized internal access.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today