CVE-2019-12987 is a critical improper input validation vulnerability affecting Citrix SD-WAN versions 10.2.x prior to 10.2.3 and NetScaler SD-WAN versions 10.0.x prior to 10.0.8. With a CVSS score of 9.8, this flaw allows unauthenticated remote attackers to execute arbitrary code, leading to complete compromise of confidentiality, integrity, and availability. While not listed on CISA's KEV catalog, a Nuclei template for remote command injection exists, indicating potential for exploitation. Despite its high severity and EPSS score, there is no evidence of active exploitation, Metasploit modules, or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 10.0, < 10.0.8CPE matchmatch criteria | cpe:2.3:a:citrix:netscaler_sd-wan:*:*:*:*:*:*:*:* | ||
>= 10.2, < 10.2.3CPE matchmatch criteria | cpe:2.3:a:citrix:sd-wan:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Citrix SD-WAN Center Multiple Vulnerabilities
Jul 2, 2019Citrix SD-WAN Center Multiple Vulnerabilities
Jul 2, 2019Citrix SD-WAN Center Multiple Vulnerabilities
Jul 2, 2019Citrix SD-WAN Center Multiple Vulnerabilities
Jul 2, 2019Citrix SD-WAN Center Multiple Vulnerabilities
Jul 2, 2019Citrix SD-WAN Center Multiple Vulnerabilities
Jul 2, 2019