Cyber Resilience

CVE-2025-6543

CriticalCISA KEVActive ExploitationEUVD Exploited

Published: 25 June 2025

Published
25 June 2025
Modified
24 October 2025
KEV Added
30 June 2025
Patch
CVSS Score v4 9.2 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0106 78.1th percentile
Risk Priority 39 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-6543 is a critical-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Citrix Netscaler Application Delivery Controller. Its CVSS base score is 9.2 (Critical).

Operationally, ranked in the top 21.9% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Deeper analysis

CVE-2025-6543 is a memory overflow vulnerability, tracked under CWE-119, that can produce unintended control flow and denial of service. It affects Citrix NetScaler ADC and NetScaler Gateway appliances when they are configured as a Gateway (including VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server.

An unauthenticated remote attacker can send crafted network traffic to trigger the flaw, potentially gaining limited control over execution or causing the affected service to become unavailable. The CVSS 4.0 score of 9.2 reflects the high impact on confidentiality, integrity, and availability despite the attack complexity and presence of preconditions.

Citrix advisory CTX694788 and the CISA Known Exploited Vulnerabilities catalog both list the issue and direct administrators to apply the vendor-supplied patches for the affected NetScaler versions. The EPSS score rose from a low baseline to a peak of 0.0305 before settling at 0.0106, indicating increased exploitation interest after disclosure.

EU & UK References

Vulnerability details

Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

CWE(s)
KEV Date Added
30 June 2025

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

citrix
netscaler application delivery controller
13.1 — 13.1-37.236 · 13.1 — 13.1-37.236 · 13.1 — 13.1-59.19
citrix
netscaler gateway
13.1 — 13.1-59.19 · 14.1 — 14.1-47.46

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly implements memory protection mechanisms that would block the CWE-119 overflow from corrupting control flow or causing DoS on the NetScaler appliance.

prevent

Requires validation of all inputs to the gateway/AAA virtual servers, preventing the malformed data that triggers the remote memory overflow.

prevent

Mandates timely application of the vendor patches referenced in CTX694788, eliminating the vulnerable code path before exploitation.

References