CVE-2025-6543
Published: 25 June 2025
Summary
CVE-2025-6543 is a critical-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Citrix Netscaler Application Delivery Controller. Its CVSS base score is 9.2 (Critical).
Operationally, ranked in the top 21.9% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-6543 is a memory overflow vulnerability, tracked under CWE-119, that can produce unintended control flow and denial of service. It affects Citrix NetScaler ADC and NetScaler Gateway appliances when they are configured as a Gateway (including VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server.
An unauthenticated remote attacker can send crafted network traffic to trigger the flaw, potentially gaining limited control over execution or causing the affected service to become unavailable. The CVSS 4.0 score of 9.2 reflects the high impact on confidentiality, integrity, and availability despite the attack complexity and presence of preconditions.
Citrix advisory CTX694788 and the CISA Known Exploited Vulnerabilities catalog both list the issue and direct administrators to apply the vendor-supplied patches for the affected NetScaler versions. The EPSS score rose from a low baseline to a peak of 0.0305 before settling at 0.0106, indicating increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-19085
Vulnerability details
Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
- CWE(s)
- KEV Date Added
- 30 June 2025
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly implements memory protection mechanisms that would block the CWE-119 overflow from corrupting control flow or causing DoS on the NetScaler appliance.
Requires validation of all inputs to the gateway/AAA virtual servers, preventing the malformed data that triggers the remote memory overflow.
Mandates timely application of the vendor patches referenced in CTX694788, eliminating the vulnerable code path before exploitation.