CVE-2024-8534

Memory safety vulnerability leading to memory corruption and Denial of Service

Published Nov 12, 2024 CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Description

Memory safety vulnerability leading to memory corruption and Denial of Service in NetScaler ADC and Gateway if the appliance must be configured as a Gateway (VPN Vserver) with RDP Feature enabled OR the appliance must be configured as a Gateway (VPN Vserver) and RDP Proxy Server Profile is created and set to Gateway (VPN Vserver) OR the appliance must be configured as a Auth Server (AAA Vserver) with RDP Feature enabled

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

NetSclaer

NetScaler ADC

unaffected

Version	Status	Constraints
`14.1`	affected	< 29.72
`13.1`	affected	< 55.34
`13.1-FIPS`	affected	< 37.207
`12.1-FIPS`	affected	< 55.321
`12.1-NDcPP`	affected	< 55.321

NetScaler

NetScaler Gateway

unaffected

Version	Status	Constraints
`14.1`	affected	< 29.72
`13.1`	affected	< 55.34
`13.1-FIPS`	affected	< 37.207
`12.1-FIPS`	affected	< 55.321
`12.1-NDcPP`	affected	< 55.321

Configuration 1 [-]

OR	cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::fips:::*
	cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::ndcpp:::*
	cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::-:::*
	cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::fips:::*
	cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::-:::*
	cpe:2.3:a:citrix:netscaler_gateway::::::::
	cpe:2.3:a:citrix:netscaler_gateway::::::::

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2024-49549	Memory safety vulnerability leading to memory corruption and Denial of Service in NetScaler ADC and Gateway if the appliance must be configured as a Gateway (VPN Vserver) with RDP Feature enabled OR the appliance must be configured as a Gateway (VPN Vserver) and RDP Proxy Server Profile is created and set to Gateway (VPN Vserver) OR the appliance must be configured as a Auth Server (AAA Vserver) with RDP Feature enabled

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact Low

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.559% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://support.citrix.com/s/article/CTX691608-netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20248534-and-cve20248535?language=en_US

History

Jul 25, 2025 6:45 PM First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Citrix Citrix netscaler Application Delivery Controller Citrix netscaler Gateway
Weaknesses		CWE-787
CPEs		cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::-:::* cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::fips:::* cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::ndcpp:::* cpe:2.3:a:citrix:netscaler_gateway::::::::
Vendors & Products		Citrix Citrix netscaler Application Delivery Controller Citrix netscaler Gateway
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Nov 22, 2024 12:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}`

Nov 13, 2024 8:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Netscaler Netscaler adc Netscaler gateway Netscaler netscaler-adc 12.1-fips Netscaler netscaler-adc 12.1-ndcpp Netscaler netscaler-adc 13.1-fips
CPEs		cpe:2.3:a:netscaler:adc:::::::: cpe:2.3:a:netscaler:gateway:::::::: cpe:2.3:a:netscaler:netscaler-adc_12.1-fips:12.1:::::::* cpe:2.3:a:netscaler:netscaler-adc_12.1-ndcpp:12.1:::::::* cpe:2.3:a:netscaler:netscaler-adc_13.1-fips::::::::
Vendors & Products		Netscaler Netscaler adc Netscaler gateway Netscaler netscaler-adc 12.1-fips Netscaler netscaler-adc 12.1-ndcpp Netscaler netscaler-adc 13.1-fips
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Nov 12, 2024 6:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Memory safety vulnerability leading to memory corruption and Denial of Service in NetScaler ADC and Gateway if the appliance must be configured as a Gateway (VPN Vserver) with RDP Feature enabled OR the appliance must be configured as a Gateway (VPN Vserver) and RDP Proxy Server Profile is created and set to Gateway (VPN Vserver) OR the appliance must be configured as a Auth Server (AAA Vserver) with RDP Feature enabled
Title		Memory safety vulnerability leading to memory corruption and Denial of Service
Weaknesses		CWE-119
References		https://support.citrix.com/s/article/CTX691608-netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20248534-and-cve20248535?language=en_US
Metrics		cvssV4_0 `{'score': 8.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:L'}`