CVE-2019-12991

Citrix SD-WAN and NetScaler suffered an authenticated command injection flaw that allowed attackers to execute arbitrary commands on the devices.

This authenticated command injection vulnerability in Citrix SD-WAN and NetScaler appliances allowed attackers to execute arbitrary system commands, leading to potential full device compromise. DIB organizations must ensure these devices are patched immediately, as the flaw was actively exploited in the wild and represents a significant supply-chain and infrastructure risk. The failure highlights the danger of relying on unpatched network appliances that can be turned into command execution platforms.

Shame score — The vulnerability was actively exploited in the wild and allowed arbitrary command execution on critical network appliances, demonstrating a severe failure in patch management and security hygiene.