CVE-2023-6548

What it actually does

CVE-2023-6548 is an authenticated remote code execution vulnerability in the NetScaler ADC and NetScaler Gateway management interface caused by improper control of generated code. An attacker who can reach a management-exposed NSIP, CLIP, or SNIP address and authenticate with low privileges can inject code that executes on the appliance. Successful exploitation can provide command execution in the context of the management plane, enabling access to sensitive configuration, credential material, traffic-management settings, and appliance-level administrative functions.

Why it matters to the business

A compromised NetScaler ADC or Gateway can affect remote access, application delivery, authentication flows, and perimeter traffic handling. Because these appliances commonly sit at the network edge and may process sensitive authentication and session data, exploitation can lead to service disruption, credential exposure, data interception, lateral movement, and loss of trust in remote-access infrastructure. This vulnerability is listed in CISA KEV with active exploitation observed in the wild and a remediation due date of 2024-01-24, so unpatched internet- or management-reachable deployments should be treated as high-priority exposure even though exploitation requires valid low-privileged credentials.

How an attack unfolds

An attacker first obtains or uses valid low-privileged credentials for the NetScaler management interface through phishing, credential reuse, exposed accounts, or prior compromise. The attacker then connects to a reachable NSIP, CLIP, or SNIP address where management access is enabled. By sending crafted authenticated requests to the management interface, the attacker abuses code-generation handling and causes arbitrary commands or code to run on the appliance. After initial execution, the attacker may enumerate configuration, extract secrets or session-related data, create or modify administrative accounts, deploy tooling or persistence, alter appliance policy, proxy traffic, or use the device as a foothold into adjacent internal systems. Public reporting and KEV status indicate real-world exploitation, so incident response should assume attackers may attempt stealthy post-exploitation rather than only one-time command execution.

How to fix it

Upgrade affected NetScaler ADC and NetScaler Gateway appliances to a vendor-fixed release and retire unsupported builds. If exact fixed versions are not already tracked internally, validate against the current Citrix/NetScaler security bulletin for CVE-2023-6548 before deployment. As compensating controls, restrict management access to dedicated administrative networks, remove internet exposure from NSIP/CLIP/SNIP management interfaces, enforce MFA and strong access controls for management accounts, disable unnecessary management services, limit low-privileged account access, and monitor for suspicious authenticated management activity. Rotate credentials and review appliance configuration if exposure existed before patching, especially where management interfaces were reachable from untrusted networks.

How to confirm the fix worked

Confirm the running NetScaler ADC or NetScaler Gateway build is at or above a vendor-fixed release using the appliance GUI or CLI version output. Validate that NSIP, CLIP, and SNIP management interfaces are not reachable from the internet or untrusted networks. Test firewall and ACL rules from representative external and internal segments to ensure only authorized administrative sources can reach management services. Review account inventory and role assignments to ensure low-privileged users do not have unnecessary management access. After upgrade, confirm normal traffic handling, Gateway authentication, HA synchronization, and configuration persistence. For vulnerability management, rescan the appliance and verify the scanner no longer reports CVE-2023-6548 or vulnerable NetScaler build numbers.

Typical attack path

1. Identify NetScaler ADC or NetScaler Gateway management interfaces exposed on NSIP, CLIP, or SNIP addresses.
2. Obtain valid low-privileged management credentials through credential theft, reuse, phishing, or another intrusion path.
3. Authenticate to the NetScaler management interface.
4. Send crafted authenticated management requests that trigger code injection.
5. Execute commands on the appliance management plane.
6. Enumerate appliance configuration, users, certificates, keys, authentication settings, and network routes.
7. Establish persistence, modify configuration, deploy tools, or create additional accounts where possible.
8. Use the compromised appliance to intercept data, disrupt service, or pivot toward internal systems.

How to detect it

Investigate whether management interfaces were reachable from untrusted networks and correlate that exposure with authentication and command activity. Review NetScaler appliance logs such as /var/log/ns.log, /var/log/httpaccess.log, /var/log/httperror.log, shell history where available, audit logs, configuration change records, and external firewall/VPN/proxy logs for authenticated access to NSIP, CLIP, or SNIP management services. Look for low-privileged users logging in from unusual IP addresses, repeated management requests followed by command execution, unexpected configuration changes, new local or administrative users, modified authentication policies, altered responder/rewrite policies, new scheduled jobs, unexpected files in temporary or web-accessible directories, and outbound connections from the appliance to unfamiliar hosts. Because this is an authenticated RCE, detections should not rely only on failed login attempts; focus on successful logins followed by anomalous management-plane behavior. If exploitation is suspected, collect a forensic image or support bundle before rebooting where feasible, preserve logs off-device, compare the running configuration to a known-good baseline, and rotate credentials, keys, and certificates that could have been accessed.

• /var/log/ns.log
• /var/log/httpaccess.log
• /var/log/httperror.log
• /var/log/bash.log
• /var/tmp/
• /tmp/
• /var/netscaler/
• /var/netscaler/gui/
• nshttpd
• nsppe
• bash -c
• sh -c
• /bin/bash
• /bin/sh
• curl http
• curl https
• wget http
• wget https
• chmod +x
• crontab
• /etc/crontab
• /var/cron/tabs/
• add system user
• set system user
• bind system user
• save ns config
• shell
• whoami
• id
• uname -a
• cat /nsconfig/ns.conf
• /nsconfig/ns.conf

What your security team should do

• Immediately identify all NetScaler ADC and NetScaler Gateway appliances, including HA pairs, lab systems, disaster-recovery systems, and appliances with management enabled on NSIP, CLIP, or SNIP addresses.
• Prioritize patching or upgrading any appliance with management access reachable from untrusted networks; KEV status and active exploitation make this urgent.
• Restrict management interfaces to trusted administrative networks or VPN-only access and block direct internet access to NSIP, CLIP, and SNIP management services.
• Audit all management users, remove stale accounts, enforce MFA where supported, rotate credentials, and review recent low-privileged logins.
• Hunt for signs of exploitation before and after patching, focusing on authenticated management activity followed by shell commands, configuration changes, new files, new accounts, or outbound connections.
• Review appliance configuration for unauthorized changes to authentication policies, responder/rewrite policies, routes, certificates, scheduled tasks, and administrative accounts.
• If suspicious activity is found, preserve appliance logs and configuration, isolate management access, rotate secrets and certificates that may have been exposed, and follow vendor incident-response guidance.
• Add recurring controls to ensure NetScaler management interfaces remain non-internet-facing and that appliance firmware stays within supported fixed versions.