Authenticated Command Injection in Citrix SD‑WAN and NetScaler Appliances (CVE‑2019‑12991)
What It Is — A command‑injection flaw (CVE‑2019‑12991) exists in Citrix SD‑WAN and NetScaler SD‑WAN appliances. An attacker who can obtain valid credentials can inject arbitrary operating‑system commands through the appliance’s management interface.
Exploitability — The vulnerability requires authentication; no public exploit code has been released, but the attack surface is low‑complexity once credentials are compromised. CVSS v3.1 base score 8.8 (High).
Affected Products — Citrix SD‑WAN Appliance and NetScaler SD‑WAN Appliance (all versions prior to the vendor‑issued patch released in 2020).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for a robust vulnerability‑management control that continuously inventories, patches, and validates critical network appliances.
- Provides audit evidence that an organization is actively monitoring for known CVEs and can prove timely remediation to auditors or customers.
- Highlights the importance of secure configuration and privileged‑access controls as part of a defensible control‑assurance posture.
Recommended Actions
- Apply the Citrix security patch for CVE‑2019‑12991 immediately on all affected appliances.
- Verify patch status with an authenticated scan or configuration audit.
- Update your asset inventory to flag SD‑WAN and NetScaler devices for continuous vulnerability monitoring.
- Review privileged‑access policies and enforce MFA for any management console access.
- Document the remediation steps and retain evidence in your control‑assurance repository.
Source: CISA KEV – CVE‑2019‑12991