CVE-2020-8193 is an improper access control vulnerability affecting Citrix ADC, Citrix Gateway, and Citrix SDWAN WAN-OP products, allowing unauthenticated access to specific URL endpoints. With a CVSS score of 6.5 (Medium), it presents a low-complexity attack vector that can be exploited remotely without authentication, potentially leading to information disclosure and unauthorized modification. This CVE is actively exploited in the wild, notably by state-sponsored actors, and has garnered significant community and media attention, including mentions in NSA advisories regarding Chinese state-sponsored hacking. While no Metasploit module exists, Nuclei templates for local file inclusion related to this vulnerability are available.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 10.5, < 10.5-70.18CPE matchmatch criteria | cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:* | ||
>= 11.1, < 11.1-64.14CPE matchmatch criteria | cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:* | ||
>= 12.0, < 12.0-63.21CPE matchmatch criteria | cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:* | ||
>= 12.1, < 12.1-57.18CPE matchmatch criteria | cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:* | ||
>= 13.0, < 13.0-58.30CPE matchmatch criteria | cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.