Number: AL25-008
Date: June 26, 2025
Updated: July 9, 2025
Audience
This Alert is intended for IT professionals and managers of notified organizations.
Purpose
An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.
Details
On June 17 and 25, 2025, Citrix published security advisories for critical vulnerabilities, CVE-2025-5349, CVE-2025-5777 and CVE-2025-6543, affecting the following productsFootnote1Footnote2:
- NetScaler ADC 12.1-FIPS – versions prior to 12.1-55.328-FIPS
- NetScaler ADC and NetScaler Gateway 14.1 – versions prior to 14.1-47.46
- NetScaler ADC and NetScaler Gateway 13.1 – versions prior to 13.1-59.19
- NetScaler ADC 13.1-FIPS and NDcPP – versions prior to 13.1-37.236-FIPS and NDcPP
NetScaler ADC and NetScaler Gateway versions 12.1 and 13.0 are now End-Of-Life (EOL) and are no longer supported.
For CVE-2025-5777 and CVE-2025-6543: NetScaler must be configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server for these vulnerabilities to be exploited.
For CVE-2025-5349: An improper access control configured on NetScaler management interface would lead to an access to NSIP, to Cluster Management IP and to local GSLB Site IP.
Citrix reports that exploitation of CVE-2025-6543 against unmitigated appliances has been observed. In response to these vulnerabilities, the Cyber Centre released AV25-350 on June 17Footnote3 and AV25-374 on June 25, 2025Footnote4.
The Cyber Centre is aware of online interest and speculation about these vulnerabilities and is publishing this Alert out of an abundance of caution.
Update 1
The Cyber Centre has observed scanning by threat actors for CVE-2025-5777 and has received reports that it is being actively exploited Footnote6. Organizations should be aware that patching does not necessarily remove access to their system from threat actors who compromised the device while it was still vulnerable. The Cyber Centre recommends organizations complete a threat hunting exercise using the potential indicators of compromise below regardless of whether you have patched for the mentioned vulnerabilities or not.
Potential Indicators of Compromise
The following indicators of compromise (IoCs) have been shared by the cyber security research community as a starting point for compromise detection.
- Depending on logging configurations, log entries with non-printable characters are a pretty good indicator that something is amiss Footnote7.
- The Citrix advisory recommends terminating existing ICA and PCoIP sessions, which leads us to believe that endpoints related to those features are being targeted. Entries for those logs may similarly contain contents of leaked memory, which may or may not include session tokens Footnote7.
- Auditing active sessions is also recommended. As an example, a single session being used from multiple client IP addresses could be an indicator that the session may have been compromised Footnote7.
- Active sessions for NetScaler Gateway can be found in the WebUI via “NetScaler Gateway -> Active User Sessions -> Select applicable context -> Continue”
- Session information can also be viewed on the command line by running commands such as “show sessions” or “show <service> session”
- In Netscaler logs, look for:
- Repeated POST requests to *doAuthentication* which will each yield 126 bytes of RAM.
- Requests to doAuthentication.do with “Content-Length: 5”.
- Lines with *LOGOFF* and user = “*#*” (i.e. # symbol in the username)
- Monitor entries for endpoint logs for contents of leaked memory, which may or may not include session tokens.
- Monitor for the creation of new user accounts, dumping or modifying configuration files, and the installation of Remote Access Tools (RATs)
Suggested actions
The Cyber Centre strongly recommends that organizations using Citrix NetScaler ADC and NetScaler Gateway appliances review the Citrix security bulletinsFootnote1Footnote2 and update or upgrade the affected systems to the following versions:
- NetScaler ADC and NetScaler Gateway 14.1-47.46 and later.
- NetScaler ADC and NetScaler Gateway 13.1-59.19 and later releases of 13.1.
- NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.236 and later releases of 13.1-FIPS and 13.1-NDcPP.
Update 1
Citrix has provided the steps to take if NetScaler ADC is suspected to be compromised Footnote8, which includes:
- Preserve evidence.
- If possible, avoid switching off the machine in order to preserve the traces needed for investigations.
- Completely isolate the machine concerned from the network, both from the Internet and from the internal network, in order to limit the risk of further unauthorized access and lateral movement.
- Revoke credentials and access.
- Examine all servers and systems to which the NetScaler ADC has connected for signs of compromise.
- Rebuild and restore.
- Rotate restored secrets.
- Harden the device.
In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre’s Top 10 IT Security ActionsFootnote5.
If activity matching the content of this alert is discovered, recipients are encouraged to report via the My Cyber Portal, or email contact@cyber.gc.ca.
References
