{"identifier":"CVE-2025-6543","cve":{"id":"CVE-2025-6543","description":"Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server","published":"2025-06-25T13:15:27.293000+00:00","modified":"2026-06-17T10:02:07.007000+00:00","status":"Analyzed","score":9.2,"severity":"CRITICAL","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_version":"4.0","affected":[{"criteria":"cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*","versionStartIncluding":"13.1","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"13.1-37.236"},{"criteria":"cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*","versionStartIncluding":"13.1","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"13.1-37.236"},{"criteria":"cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*","versionStartIncluding":"13.1","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"13.1-59.19"},{"criteria":"cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*","versionStartIncluding":"14.1","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"14.1-47.46"},{"criteria":"cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*","versionStartIncluding":"13.1","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"13.1-59.19"},{"criteria":"cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*","versionStartIncluding":"14.1","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"14.1-47.46"}],"weaknesses":["CWE-119"],"references":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694788","source":"secure@citrix.com","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6543","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"]}],"kev":{"cveID":"CVE-2025-6543","vendorProject":"Citrix","product":"NetScaler ADC and Gateway","vulnerabilityName":"Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability","dateAdded":"2025-06-30","shortDescription":"Citrix NetScaler ADC and Gateway contain a buffer overflow vulnerability leading to unintended control flow and Denial of Service. NetScaler must be configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","dueDate":"2025-07-21","knownRansomwareCampaignUse":"Unknown","forensicTriage":"No","notes":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694788 ; https://www.netscaler.com/blog/news/netscaler-critical-security-updates-for-cve-2025-6543-and-cve-2025-5777/ ;   https://nvd.nist.gov/vuln/detail/CVE-2025-6543","cwes":["CWE-119"]},"kev_checked":true,"metrics":{"cvssMetricV40":[{"source":"secure@citrix.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-07-17T03:55:32.992762Z","id":"CVE-2025-6543","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*","versionStartIncluding":"13.1","versionEndExcluding":"13.1-37.236","matchCriteriaId":"0F079648-790A-4D18-908D-25CA575C5B46"},{"vulnerable":true,"criteria":"cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*","versionStartIncluding":"13.1","versionEndExcluding":"13.1-37.236","matchCriteriaId":"CF89AD2E-8A0A-43A9-9EEB-83D595576775"},{"vulnerable":true,"criteria":"cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*","versionStartIncluding":"13.1","versionEndExcluding":"13.1-59.19","matchCriteriaId":"355DCB05-54E3-4C13-A74A-B27CE3F10597"},{"vulnerable":true,"criteria":"cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*","versionStartIncluding":"14.1","versionEndExcluding":"14.1-47.46","matchCriteriaId":"4A26624D-7F3F-4FD7-AC50-C9BDCA656F7B"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*","versionStartIncluding":"13.1","versionEndExcluding":"13.1-59.19","matchCriteriaId":"598029C6-734C-450C-A7EC-495C72819E88"},{"vulnerable":true,"criteria":"cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*","versionStartIncluding":"14.1","versionEndExcluding":"14.1-47.46","matchCriteriaId":"D977C8AE-4B4E-474D-ABD6-F55F054E5B59"}]}]}],"source":"nvd","retrieved_at":"2026-10-29T23:36:31.789752+00:00","exploited":true,"kev_stale":false,"products":["citrix / netscaler application delivery controller","citrix / netscaler gateway"],"priority":{"label":"Known exploitation: prioritize review","reasons":["CISA KEV lists real-world exploitation."]},"epss":{"probability":0.10433,"percentile":0.95725,"date":"2026-10-29","stale":false},"version_assessment":null},"news":[],"campaigns":[],"domains":[{"domain":"support.citrix.com","source_url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694788","investigate_url":"https://investigate.aeglixmind.com/#support.citrix.com"},{"domain":"www.cisa.gov","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6543","investigate_url":"https://investigate.aeglixmind.com/#www.cisa.gov"}],"arsenal_url":"https://arsenal.aeglixmind.com/?cve=CVE-2025-6543","catalog_url":"https://cves.aeglixmind.com/cve/CVE-2025-6543","research_url":"https://investigate.aeglixmind.com/research/cve/CVE-2025-6543","coverage":{"news_candidates_checked":0,"campaign_candidates_checked":0,"bounded":false,"notice":"Exact CVE mentions in stored public excerpts and reviewed campaign content only. A mention is not proof of exploitation, attribution or tool suitability. Missing matches do not establish absence."}}