Threat alert details
We would like to bring your attention to a recent security bulletin surrounding Citrix Gateway and Citrix ADC. Vulnerabilities have been discovered in Citrix Gateway and Citrix ADC, listed below. Note that only appliances that are operating as a Gateway (appliances using the SSL VPN functionality or deployed as an ICA proxy with authentication enabled) are affected by the first issue, which is rated as a Critical severity vulnerability.
| CVE | Description | Affected Products | Pre-conditions |
| CVE-2022-27510 | Unauthorized access to Gateway user capabilities | Citrix Gateway, Citrix ADC | Appliance must be configured as a VPN (Gateway). |
| CVE-2022-27513 | Remote desktop takeover via phishing | Citrix Gateway, Citrix ADC | Appliance must be configured as a VPN (Gateway) and the RDP proxy functionality must be configured. |
| CVE-2022-27516 | User login brute force protection functionality bypass | Citrix Gateway, Citrix ADC | Appliance must be configured as a VPN (Gateway) OR AAA virtual server and the user lockout functionality “Max Login Attempts” must be configured |
Affected Products
The following versions of Citrix ADC and Citrix Gateway are affected
- Citrix ADC and Citrix Gateway 13.1 before 13.1-33.47
- Citrix ADC and Citrix Gateway 13.0 before 13.0-88.12
- Citrix ADC and Citrix Gateway 12.1 before 12.1.65.21
- Citrix ADC 12.1-FIPS before 12.1-55.289
- Citrix ADC 12.1-NDcPP before 12.1-55.289
Remediation
Affected customers of Citrix ADC and Citrix Gateway are recommended to install the relevant updated versions of Citrix ADC or Citrix Gateway as soon as possible:
- Citrix ADC and Citrix Gateway 13.1-33.47 and later releases
- Citrix ADC and Citrix Gateway 13.0-88.12 and later releases of 13.0
- Citrix ADC and Citrix Gateway 12.1-65.21 and later releases of 12.1
- Citrix ADC 12.1-FIPS 12.1-55.289 and later releases of 12.1-FIPS
- Citrix ADC 12.1-NDcPP 12.1-55.289 and later releases of 12.1-NDcPP
Please note that Citrix ADC and Citrix Gateway versions prior to 12.1 are EOL and customers on those versions are recommended to upgrade to one of the supported versions.
