CVE-2022-27518 Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass
Unauthenticated attackers can execute arbitrary code remotely on Citrix ADC and Gateway devices, requiring immediate patching.
- Exploited in the wild
- Since 13 Dec 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-27518?
CVE-2022-27518 is a critical code injection vulnerability in Citrix Gateway, Citrix ADC, published on 13 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Unauthenticated remote arbitrary code execution
Weakness: CWE-664
Which versions are affected by CVE-2022-27518?
It affects 2 products.
Products include Citrix Application Delivery Controller Firmware, Citrix Gateway Firmware.
How do I fix CVE-2022-27518?
No fix has been published for CVE-2022-27518 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 Jan 2023.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-27518 being exploited?
Yes. Attackers have exploited CVE-2022-27518 in the wild since at least 13 Dec 2022.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Citrix Gateway, Citrix ADC
- CVE-2019-19781 Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution
- CVE-2020-8193 Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass
- CVE-2020-8195 Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure
- CVE-2020-8196 Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure
- CVE-2022-27510 Unauthorized access to Gateway user capabilities
Sources
Also known as GHSA-w8vh-3g88-rg95.