CVE-2025-8424

Improper access control on the NetScaler Management Interface

En bref

Sévérité: HIGH 8.7
EPSS: EPSS 3.73 % · centile 90 (2026-10-27)
État: PUBLISHED
Publiée: 2025-08-26
Mise à jour: 2026-02-26
Attribuée par: Citrix
Statut NVD: Deferred

Description

Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway when an attacker can get access to the appliance NSIP, Cluster Management IP or local GSLB Site IP or SNIP with Management Access

Scores

Version	Score	Vecteur	Évalué par
CVSS 4.0	HIGH 8.7	CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L	Citrix
CVSS 4.0	HIGH 8.7	CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · secure@citrix.com (Secondary)

Faiblesses (CWE)

CWE-1284

Références européennes

ENISA EUVD · EUVD-2025-25868
GCVE · GCVE-0-2025-8424

Avis du CERT-FR

CERTFR-2025-AVI-0730 — Multiples vulnérabilités dans Citrix NetScaler ADC et NetScaler Gateway · cert.ssi.gouv.fr

Produits affectés

Produit	Versions
NetScaler · ADC	affected 14.1 < 47.48 ; affected 13.1 < 59.22 ; affected 13.1 FIPS and NDcPP < 37.241 ; affected 12.1 FIPS and NDcPP < 55.330
NetScaler · Gateway	affected 14.1 < 47.48 ; affected 13.1 < 59.22 ; affected 13.1 FIPS and NDcPP < 37.241 ; affected 12.1 FIPS and NDcPP < 55.330

Références

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD