CVE-2025-5777

Name of the Vulnerable Software and Affected Versions Citrix NetScaler Application Delivery Controller versions prior to 12.1-55.328 Citrix NetScaler Application Delivery Controller versions prior to 13.1-37.235 Citrix NetScaler Application Delivery Controller versions prior to 13.1-58.32 Citrix NetScaler Application Delivery Controller versions prior to 14.1-43.56 Citrix NetScaler Gateway versions prior to 13.1-58.32 Citrix NetScaler Gateway versions prior to 14.1-43.56

Description This pre-authentication memory disclosure issue occurs due to insufficient input validation, leading to a memory overread (out-of-bounds read) when the system is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. An attacker can send a specially crafted POST request to the /p/u/doAuthentication.do endpoint with the login parameter provided without an equals sign or value. This causes the server to return fragments of uninitialized process memory within the <InitialValue> XML element, leaking approximately 127 bytes per request. This information can be analyzed to extract valid session tokens, enabling session hijacking and multi-factor authentication (MFA) bypass. Real-world exploitation has been observed by Anubis ransomware affiliates to gain initial access to systems, subsequently using legitimate Remote Management and Monitoring (RMM) tools to maintain persistence and deploy ransomware.

Recommendations Update Citrix NetScaler Application Delivery Controller to version 12.1-55.328 or later. Update Citrix NetScaler Application Delivery Controller to version 13.1-37.235 or later. Update Citrix NetScaler Application Delivery Controller to version 13.1-58.32 or later. Update Citrix NetScaler Application Delivery Controller to version 14.1-43.56 or later. Update Citrix NetScaler Gateway to version 13.1-58.32 or later. Update Citrix NetScaler Gateway to version 14.1-43.56 or later. As a temporary mitigation, configure a Web Application Firewall (WAF) rule to block POST requests to the /p/u/doAuthentication.do endpoint that contain the login parameter without an assigned value.