# MA-760.012020: MyCERT Advisory - Citrix Application Delivery Controller and Citrix Gateway web server vulnerability (CVE-2019-19781))

**Date:** 14 Jan 2020  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-760.012020  
**Advisory ID:** MA-760.012020

---

**1.0 Introduction**
Recently,a vulnerability been identified in Citrix Application Delivery Controller (ADC) formerly known as NetScaler ADC and Citrix Gateway formerly known as NetScaler Gateway that could allow an unauthenticated remote attacker to execute arbitrary code on a vulnerable system.This vulnerability is rated critical and has been assigned CVE number; [[CVE-2019-19781](https://support.citrix.com/article/CTX267027)].
**2.0 Impact**
By exploiting this vulnerability, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable servers.
**3.0 Affected Products**
The vulnerability affects all supported product versions and all supported platforms:
• Citrix ADC and Citrix Gateway version 13.0 all supported builds
• Citrix ADC and NetScaler Gateway version 12.1 all supported builds
• Citrix ADC and NetScaler Gateway version 12.0 all supported builds
• Citrix ADC and NetScaler Gateway version 11.1 all supported builds
• Citrix NetScaler ADC and NetScaler Gateway version 10.5 all supported builds
**4.0 Recommendations**
As of the writing of this advisory, Citrix has not released any security patches for this vulnerability. However, users can use the following knowledge base article that contains the steps to deploy a responder policy to mitigate the issue in the interim until a permanent fix is available: [CTX267679 - Mitigation steps for CVE-2019-19781](https://support.citrix.com/article/CTX267679)
Citrix expects to have firmware updates in the form of refresh builds to be available across all supported versions of Citrix ADC and Citrix Gateway before the end of January 2020. Please refer to the table below for the expected release dates.
|  |
| --- | --- | --- | **Version** | **Refresh Build** | **Expected Release Date** | 10.5 | 10.5.70.x | 31st January 2020 | 11.1 | 11.1.63.x | 20th January 2020 | 12.0 | 12.0.63.x | 20th January 2020 | 12.1 | 12.1.55.x | 27th January 2020 | 13.0 | 13.0.47.x | 27th January 2020 |
Generally, MyCERT advises the users of this firmware to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 - 8008 7000 (Office Hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- <https://www.us-cert.gov/ncas/current-activity/2020/01/13/cisa-releases-test-citrix-adc-and-gateway-vulnerability>
- <https://support.citrix.com/article/CTX267027>
- <https://www.kb.cert.org/vuls/id/619785/>
- <https://github.com/cisagov/check-cve-2019-19781>
- <https://www.bleepingcomputer.com/news/security/citrix-adc-cve-2019-19781-exploits-released-fix-now/>
- <https://thehackernews.com/2020/01/citrix-adc-gateway-exploit.html>
- <https://www.citrix.com/blogs/2020/01/11/citrix-provides-update-on-citrix-adc-citrix-gateway-vulnerability/>