CVE-2019-12989
Published: 16 July 2019
Summary
CVE-2019-12989 is a critical-severity SQL Injection (CWE-89) vulnerability in Citrix Netscaler Sd-Wan. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The vulnerability is an SQL injection flaw, tracked as CVE-2019-12989 and mapped to CWE-89, that affects Citrix SD-WAN 10.2.x releases prior to 10.2.3 and NetScaler SD-WAN 10.0.x releases prior to 10.0.8. It carries a CVSS 3.1 base score of 9.8, reflecting a network-accessible attack vector with low attack complexity and no required privileges or user interaction.
Unauthenticated remote attackers can supply crafted input to trigger the injection, enabling full read/write access and arbitrary command execution on the affected appliances. Public proof-of-concept material demonstrates that successful exploitation leads directly to authentication bypass followed by remote command execution.
Citrix security bulletin CTX251987, along with analysis from Tenable (TRA-2019-32) and PacketStorm disclosures, addresses the affected versions and points administrators to the corresponding patched releases.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-4564
Vulnerability details
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.
- CWE(s)
- KEV Date Added
- 25 March 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of all inputs to block crafted SQL payloads that trigger the injection.
Mandates prompt application of vendor patches (10.2.3 / 10.0.8) that eliminate the SQLi flaw.
Boundary-protection mechanisms can restrict unauthenticated remote access and inspect traffic for injection attempts.