CVE-2020-8196

CVE-2020-8196 is an improper access control (CWE-284) issue in Citrix ADC, Citrix Gateway, and Citrix SD-WAN WANOP appliances that results in information disclosure. An unauthenticated attacker who can reach the appliance's web interface can retrieve limited configuration details, including the password hash of the primary administrative account (nsroot), without logging in. That information can be used for follow-on actions such as offline password cracking and deeper compromise of the appliance. Organizations running affected builds of Citrix ADC, Citrix Gateway, or Citrix SD-WAN WANOP appliances are in scope. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2021-11-03, confirming in-the-wild exploitation; no public proof-of-concept is cataloged and ransomware use is unconfirmed.

What to do: Apply the fixed builds Citrix supplies per vendor instructions (Citrix advisory CTX276688 lists affected and fixed ADC/Gateway builds; the SD-WAN WANOP advisory lists the applicable appliance builds). Prioritize internet-facing ADC/Gateway devices, restrict management-interface access to trusted networks, and rotate the primary/nsroot password on any appliance that may have been accessed since the flaw's disclosure.