Information Disclosure in Citrix ADC, Gateway, and SD‑WAN WANOP (CVE‑2020‑8195)
What It Is – Citrix ADC, Citrix Gateway, and several Citrix SD‑WAN WANOP appliance models contain an information‑disclosure flaw that can allow an unauthenticated network‑adjacent attacker to read sensitive configuration files.
Exploitability – The vulnerability is publicly disclosed, has a CVSS 3.1 base score of 7.5 (High), and proof‑of‑concept exploits have been published. No known active ransomware or data‑theft campaigns are linked, but the flaw can be leveraged to harvest internal network topology and credentials.
Affected Products – Citrix ADC (formerly NetScaler), Citrix Gateway, and Citrix SD‑WAN WANOP appliances (multiple firmware versions prior to the vendor‑issued patch).
Why It Matters for Trust & Control Assurance
- Data confidentiality controls – The flaw bypasses intended segregation of configuration data, testing the effectiveness of your confidentiality and access‑control policies.
- Patch‑management evidence – Demonstrating timely remediation is a core audit artifact; the vulnerability highlights gaps in your vulnerability‑remediation lifecycle.
- Continuous monitoring – Detecting unauthorized reads of configuration files requires logging and alerting that map to control objectives across SOC 2, ISO 27001, and NIST CSF.
Recommended Actions
- Identify all Citrix ADC, Gateway, and SD‑WAN WANOP instances in scope.
- Apply the Citrix‑released security patch (or upgrade to a non‑vulnerable firmware version) immediately.
- Validate that the patch is effective by scanning for the CVE‑2020‑8195 fingerprint.
- Update your asset inventory and vulnerability‑management dashboard to reflect remediation status.
- Enable detailed logging of configuration‑file accesses and integrate alerts into your SIEM for continuous assurance.
Source: CISA KEV – CVE‑2020‑8195