CVE-2022-27513

Published: Nov 8, 2022Modified: Jun 17, 2026

9.6

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 6.0

Source: NVD

Description

Remote desktop takeover via phishing

Affected (8)

Products: Citrix: Gateway, Application Delivery Controller Firmware

2 products

Application Delivery Controller Firmware

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Citrix Gateway	From 12.1 to 12.1-65.21
Citrix Gateway	From 13.0 to 13.0-88.12
Citrix Gateway	From 13.1 to 13.1-33.41

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Citrix Application Delivery Controller Firmware	From 12.1 to 12.1-65.21
Citrix Application Delivery Controller Firmware	From 13.0 to 13.0-88.12
Citrix Application Delivery Controller Firmware	From 13.1 to 13.1-33.47

Configuration C

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Citrix Application Delivery Controller Firmware	From 12.1 to 12.1-55.289
Citrix Application Delivery Controller Firmware	From 12.1 to 12.1-55.289

Running on/with	Platform Versions
Citrix Application Delivery Controller	All versions

Related CWEs

Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

References (2)

https://support.citrix.com/article/CTX463706/citrix-gateway-and-citrix-adc-security-bulletin-for-cve202227510-cve202227513-and-cve202227516

Source: secure@citrix.com

Vendor Advisory

https://support.citrix.com/article/CTX463706/citrix-gateway-and-citrix-adc-security-bulletin-for-cve202227510-cve202227513-and-cve202227516

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.