Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 4 of 6).

The remote Citrix SD-WAN Center or NetScaler SD-WAN Center is affected by a remote command injection vulnerability due to improper sanitization of user-supplied input in the addModifyZTDProxy action of NmsController. An unauthenticated, remote attacker can exploit this, via a specially crafted HTTP request, to execute arbitrary commands on the remote host with root privileges.

Note that Nessus can perform an additional check for this vulnerability. To do so, re-run the scan with the setting 'Perform thorough tests (may disrupt your network or impact scan speed)' enabled.

Detections

Analytics

CVE-2019-12988

critical

Tenable Plugins

critical