CVE-2019-12991

CVE-2019-12991 is an operating system command injection flaw (CWE-78) caused by improper input validation in the management interface of Citrix SD-WAN and NetScaler SD-WAN appliances. A remote attacker who holds low-privileged credentials on the appliance's management interface can send crafted input that gets executed as OS commands, yielding full command execution with high impact on confidentiality, integrity, and availability. Public exploit references, including a PoC that combines an authentication bypass with remote command execution on a Citrix SD-WAN Appliance 10.2.2, demonstrate the practical attack path against these appliances. Administrators running Citrix SD-WAN 10.2.x prior to 10.2.3 or NetScaler SD-WAN 10.0.x prior to 10.0.8 are affected. The flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-25, required action: apply updates per vendor instructions), and its 74.1% EPSS probability indicates a high likelihood of exploitation, so exploitation in the wild should be assumed.

What to do: Upgrade Citrix SD-WAN 10.2.x deployments to 10.2.3 (or later) and NetScaler SD-WAN 10.0.x deployments to 10.0.8 (or later) per vendor instructions. Restrict the appliance management interface to trusted management networks rather than the public internet, and review management-interface access logs for signs of authentication bypass or unauthorized command execution. Inventory all appliances on the 10.2.x and 10.0.x branches, since this flaw is listed in CISA's KEV catalog and rapid patching is required.