{"id":"CVE-2025-8424","state":"PUBLISHED","title":"Improper access control on the NetScaler Management Interface","description":"Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway when an attacker can get access to the appliance NSIP, Cluster Management IP or local GSLB Site IP or SNIP with Management Access","publishedAt":"2025-08-26T13:11:10.822Z","updatedAt":"2026-02-26T17:48:11.563Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","source":"Citrix"},"assigner":"Citrix","products":["NetScaler ADC","NetScaler Gateway"],"affected":[{"vendor":"NetScaler","product":"ADC","defaultStatus":"unaffected","versions":[{"version":"14.1","status":"affected","lessThan":"47.48","versionType":"patch"},{"version":"13.1","status":"affected","lessThan":"59.22","versionType":"patch"},{"version":"13.1 FIPS and NDcPP","status":"affected","lessThan":"37.241","versionType":"patch"},{"version":"12.1 FIPS and NDcPP","status":"affected","lessThan":"55.330","versionType":"patch"}]},{"vendor":"NetScaler","product":"Gateway","defaultStatus":"unaffected","versions":[{"version":"14.1","status":"affected","lessThan":"47.48","versionType":"patch"},{"version":"13.1","status":"affected","lessThan":"59.22","versionType":"patch"},{"version":"13.1 FIPS and NDcPP","status":"affected","lessThan":"37.241","versionType":"patch"},{"version":"12.1 FIPS and NDcPP","status":"affected","lessThan":"55.330","versionType":"patch"}]}],"references":["https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938"],"weaknesses":["CWE-1284"],"ingestedAt":"2026-10-29T20:10:04.440Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/8xxx/CVE-2025-8424.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-8424","state":"PUBLISHED","datePublished":"2025-08-26T13:11:10.822Z","dateUpdated":"2026-02-26T17:48:11.563Z","assignerShortName":"Citrix","assignerOrgId":"e437aed5-38e0-4fa3-a98b-cb73e7acaec6","dateReserved":"2025-07-31T15:12:42.021Z"},"containers":{"cna":{"title":"Improper access control on the NetScaler Management Interface","descriptions":[{"lang":"en","value":"Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway when an attacker can get access to the appliance NSIP, Cluster Management IP or local GSLB Site IP or SNIP with Management Access"}],"affected":[{"vendor":"NetScaler","product":"ADC","defaultStatus":"unaffected","versions":[{"version":"14.1","status":"affected","lessThan":"47.48","versionType":"patch"},{"version":"13.1","status":"affected","lessThan":"59.22","versionType":"patch"},{"version":"13.1 FIPS and NDcPP","status":"affected","lessThan":"37.241","versionType":"patch"},{"version":"12.1 FIPS and NDcPP","status":"affected","lessThan":"55.330","versionType":"patch"}]},{"vendor":"NetScaler","product":"Gateway","defaultStatus":"unaffected","versions":[{"version":"14.1","status":"affected","lessThan":"47.48","versionType":"patch"},{"version":"13.1","status":"affected","lessThan":"59.22","versionType":"patch"},{"version":"13.1 FIPS and NDcPP","status":"affected","lessThan":"37.241","versionType":"patch"},{"version":"12.1 FIPS and NDcPP","status":"affected","lessThan":"55.330","versionType":"patch"}]}],"references":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","baseScore":8.7,"baseSeverity":"HIGH","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1284","description":"CWE-1284 Improper Validation of Specified Quantity in Input","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Citrix","orgId":"e437aed5-38e0-4fa3-a98b-cb73e7acaec6","dateUpdated":"2025-08-26T13:11:10.822Z"},"datePublic":"2025-08-26T13:06:00.000Z","source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-8424","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-08-27T03:55:15.625808Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-26T17:48:11.563Z"}}]}}}