A path traversal in Citrix ADC let attackers run code without logging in. Patches took a month — mitigation steps were the only defence in the meantime.
Publicly disclosed: 17 December 2019
On 17 December 2019 Citrix disclosed a vulnerability in Citrix ADC (NetScaler) and Citrix Gateway. A directory traversal allowed an unauthenticated attacker to execute code on the appliance. Citrix published a configuration mitigation immediately, but permanent fixes were released only in January 2020. When exploit code became public in early January, mass scanning began; many devices without the mitigation were compromised, and some were used as entry points for ransomware.
| CVE | Severity | Affected | Fixed in |
|---|---|---|---|
CVE-2019-19781 | Critical, CVSS 9.8 (path traversal, remote code execution) | Citrix ADC and Gateway 10.5, 11.1, 12.0, 12.1, 13.0; SD-WAN WANOP | Fixed builds released 19–24 January 2020 |
The time between disclosure and patch is not a waiting period — it is the most dangerous period.
Sources: Citrix CTX267027, NVD CVE-2019-19781.
Need help with this? Contact CySec for a free consultation.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.
