Citrix Products Remote Code Execution Vulnerability

Impact

• Remote Code Execution

System / Technologies affected

• Citrix ADC and Citrix Gateway 13.0 before 13.0-58.32 

• Citrix ADC and Citrix Gateway 12.1 before 12.1-65.25 

• Citrix ADC 12.1-FIPS before 12.1-55.291 

• Citrix ADC 12.1-NDcPP before 12.1-55.291

Please refer to the link below for detail:

• https://support.citrix.com/article/CTX474995/citrix-adc-and-citrix-gateway-security-bulletin-for-cve202227518

Solutions

Before installation of the software, please visit the vendor web-site for more details.

Apply fixes issued by the vendor:

• Citrix ADC and Citrix Gateway 13.0-58.32 and later releases 

• Citrix ADC and Citrix Gateway 12.1-65.25 and later releases of 12.1 

• Citrix ADC 12.1-FIPS 12.1-55.291 and later releases of 12.1-FIPS  

• Citrix ADC 12.1-NDcPP 12.1-55.291 and later releases of 12.1-NDcPP 

Please note that Citrix ADC and Citrix Gateway versions prior to 12.1 are EOL and customers on those versions are recommended to upgrade to one of the supported versions. 

Vulnerability Identifier

• CVE-2022-27518

Source

• AusCERT
• USCERT
• Citrix

Related Link

• https://www.auscert.org.au/bulletins/ESB-2022.6474
• https://www.cisa.gov/uscert/ncas/current-activity/2022/12/13/citrix-releases-security-updates-citrix-adc-citrix-gateway
• https://support.citrix.com/article/CTX474995/citrix-adc-and-citrix-gateway-security-bulletin-for-cve202227518