CVE-2025-7775: Technical Deep-Dive (Auto Refreshed)

Generated on 2026-03-23T21:42:41.579Z. This file is automatically regenerated every 30 minutes by the CVE AI enrichment job using web sources (NVD, MITRE, CISA KEV, GitHub).

Executive Technical Summary

Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with IPv6 services or servicegroups bound with IPv6 servers (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with DBS IPv6 services or servicegroups bound with IPv6 DBS servers (OR) CR virtual server with type HDX

• Context preserved from previous revision: Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with IPv6 services or servicegroups bound with IPv6 servers (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with DBS IPv6 services or servicegroups bound with IPv6 DBS servers (OR) CR virtual server with type HDX Notes: 📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

Technical Details

• CVE: CVE-2025-7775
• KEV date added: 2025-08-26
• KEV due date: 2025-08-28
• NVD published: 2025-08-26
• NVD modified: 2025-10-24
• MITRE modified: 2026-02-26
• CVSS base score: 9.8
• CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• CVSS exploitability score: 3.9
• CVSS impact score: 5.9
• Attack vector: Network
• Attack complexity: Low
• Privileges required: None
• User interaction: None
• Scope: Unchanged
• Confidentiality impact: High
• Integrity impact: High
• Availability impact: High

Versions and Products Impacted

• citrix / netscaler application delivery controller (versions: >= 12.1, < 12.1-55.330)
• citrix / netscaler application delivery controller (versions: >= 13.1, < 13.1-37.241)
• citrix / netscaler application delivery controller (versions: >= 13.1, < 13.1-59.22)
• citrix / netscaler application delivery controller (versions: >= 14.1, < 14.1-47.48)
• citrix / netscaler gateway (versions: >= 13.1, < 13.1-59.22)
• citrix / netscaler gateway (versions: >= 14.1, < 14.1-47.48)
• NetScaler / ADC (versions: 14.1, 13.1, 13.1 FIPS and NDcPP, 12.1 FIPS and NDcPP)
• NetScaler / Gateway (versions: 14.1, 13.1, 13.1 FIPS and NDcPP, 12.1 FIPS and NDcPP)

Weakness Classification

• CWE-119

Repositories for Lab Validation (Public Examples)

• nomi-sec/PoC-in-GitHub | stars: 7594 | updated: 2026-03-23 | https://github.com/nomi-sec/PoC-in-GitHub
  Notes: 📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.
• DarkFunct/TK-CVE-Repo | stars: 43 | updated: 2026-03-23 | https://github.com/DarkFunct/TK-CVE-Repo
  Notes: TK-CVE-Repo
• vulnersCom/vulners-mcp | stars: 4 | updated: 2026-03-23 | https://github.com/vulnersCom/vulners-mcp

People and Organizations Mentioned

• Citrix
• NetScaler
• nomi-sec
• DarkFunct
• vulnersCom

Practical Defensive Validation (Authorized Only)

1. Use only isolated environments and systems you own or are explicitly authorized to test.
2. Snapshot infrastructure before validation and preserve baseline logs (EDR, SIEM, OS, app).
3. Use citrix / netscaler application delivery controller (versions: >= 12.1, < 12.1-55.330) in isolated VM snapshots (vulnerable vs patched) and compare process tree telemetry before/after updates.
4. Validate command-execution prevention policies (AppLocker/WDAC/EDR) with harmless test binaries only.
5. Create SIEM detections for suspicious parent-child chains, encoded command usage, and abnormal service creation.

References

• NVD record: https://nvd.nist.gov/vuln/detail/CVE-2025-7775
• MITRE CVE record: https://www.cve.org/CVERecord?id=CVE-2025-7775
• CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CISA KEV JSON feed: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
• KEV notes: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938 ; https://nvd.nist.gov/vuln/detail/CVE-2025-7775
• https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-7775
• Repository example: https://github.com/nomi-sec/PoC-in-GitHub
• Repository example: https://github.com/DarkFunct/TK-CVE-Repo
• Repository example: https://github.com/vulnersCom/vulners-mcp

This content is for defensive security training and authorized validation only.