CVE-2025-5777

🗓️ 17 Jun 2025 12:29:34Reported by CitrixType

cve🔗 web.nvd.nist.gov📰️ 54 Media mentions👁 315 Views🌐 WEB

Insufficient input validation on NetScaler ADC and Gateway causes memory overread vulnerability.

Reporter	Title	Published	Views	Family All 57
GithubExploit	Exploit for Out-of-bounds Read in Citrix Netscaler_Application_Delivery_Controller	5 Jul 202523:56	–	githubexploit
GithubExploit	Exploit for Out-of-bounds Read in Citrix Netscaler_Application_Delivery_Controller	20 Aug 202510:51	–	githubexploit
GithubExploit	Exploit for Out-of-bounds Read in Citrix Netscaler_Application_Delivery_Controller	10 Jul 202507:15	–	githubexploit
GithubExploit	Exploit for Out-of-bounds Read in Citrix Netscaler_Application_Delivery_Controller	11 Aug 202515:47	–	githubexploit
GithubExploit	Exploit for Out-of-bounds Read in Citrix Netscaler_Application_Delivery_Controller	15 Jul 202517:49	–	githubexploit
GithubExploit	Exploit for Out-of-bounds Read in Citrix Netscaler_Application_Delivery_Controller	8 Jul 202514:12	–	githubexploit
GithubExploit	Exploit for Out-of-bounds Read in Citrix Netscaler_Application_Delivery_Controller	23 Jul 202512:05	–	githubexploit
GithubExploit	Exploit for Out-of-bounds Read in Citrix Netscaler_Application_Delivery_Controller	16 Jul 202515:12	–	githubexploit
GithubExploit	Exploit for Out-of-bounds Read in Citrix Netscaler_Application_Delivery_Controller	30 Jun 202511:02	–	githubexploit
GithubExploit	Exploit for Injection in Nikhil-Bhalerao Open_Source_Clinic_Management_System	9 Jul 202507:30	–	githubexploit

NVD

Node

citrix netscaler_application_delivery_controllerRange12.1–12.1-55.328fips

citrix netscaler_application_delivery_controllerRange13.1–13.1-37.235fips

citrix netscaler_application_delivery_controllerRange13.1–13.1-37.235ndcpp

citrix netscaler_application_delivery_controllerRange13.1–13.1-58.32-

citrix netscaler_application_delivery_controllerRange14.1–14.1-43.56-

citrix netscaler_gatewayRange13.1–13.1-58.32

citrix netscaler_gatewayRange14.1–14.1-43.56

[
  {
    "defaultStatus": "unaffected",
    "product": "ADC",
    "vendor": "NetScaler",
    "versions": [
      {
        "lessThan": "43.56",
        "status": "affected",
        "version": "14.1",
        "versionType": "patch"
      },
      {
        "lessThan": "58.32",
        "status": "affected",
        "version": "13.1",
        "versionType": "patch"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Gateway",
    "vendor": "NetScaler",
    "versions": [
      {
        "lessThan": "43.56",
        "status": "affected",
        "version": "14.1",
        "versionType": "patch"
      },
      {
        "lessThan": "58.32",
        "status": "affected",
        "version": "13.1",
        "versionType": "patch"
      }
    ]
  }
]

Source	Link
support	www.support.citrix.com/support-home/kbsearch/article
netscaler	www.netscaler.com/blog/news/netscaler-critical-security-updates-for-cve-2025-6543-and-cve-2025-5777/
labs	www.labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
theregister	www.theregister.com/2025/07/10/cisa_citrixbleed_kev/
bleepingcomputer	www.bleepingcomputer.com/news/security/cisa-tags-citrix-bleed-2-as-exploited-gives-agencies-a-day-to-patch/
reliaquest	www.reliaquest.com/blog/threat-spotlight-citrix-bleed-2-vulnerability-in-netscaler-adc-gateway-devices/
doublepulsar	www.doublepulsar.com/citrixbleed-2-exploitation-started-mid-june-how-to-spot-it-f3106392aa71
citrixbleed	www.citrixbleed.com/
horizon3	www.horizon3.ai/attack-research/attack-blogs/cve-2025-5777-citrixbleed-2-write-up-maybe/

Parameter	Position	Path	Description	CWE
login	request body	/p/u/doAuthentication.do	Citrix NetScaler ADC/Gateway vulnerability enabling memory disclosure via an out-of-bounds read during authentication	CWE-457, CWE-908, CWE-125

30 Oct 2025 20:10Current

9.6High risk

Vulners AI Score9.6

CVSS 3.17.5

CVSS 49.3

EPSS0.64972

SSVC

cve 2025 5777 netscaler adc insufficient input validation memory overread netscaler gateway.