CVE-2017-14602 Auth bypass in n/a

High 7.2 Published 26 Sep 2017 Updated 5 Aug 2024

An attacker with management interface access can bypass authentication to gain administrative control of the Citrix NetScaler appliance.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-14602?

CVE-2017-14602 is a high-severity authentication bypass vulnerability in n/a, published on 26 Sep 2017. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A vulnerability has been identified in the management interface of Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.1 before build 135.18, 10.5 before build 66.9, 10.5e before build 60.7010.e, 11.0 before build 70.16, 11.1 before build 55.13, and 12.0 before build 53.13 (except for build 41.24) that, if exploited, could allow an attacker with access to the NetScaler management interface to gain administrative access to the appliance.

Weakness: CWE-287

Which versions are affected by CVE-2017-14602?

It affects 2 products.

Products include Citrix Application Delivery Controller Firmware, Citrix Netscaler Gateway Firmware.

How do I fix CVE-2017-14602?

No fix has been published for CVE-2017-14602 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2017-14602 being exploited?

There is no known exploitation of CVE-2017-14602 in the wild and no public exploit code.

Sources

Also known as GHSA-m34h-9xmf-w4xr.