{"type":"rich","version":"1.0","provider_name":"Transistor","provider_url":"https://transistor.fm","author_name":"Daily Security Review","title":"CitrixBleed Returns: CVE-2025-5777 and the Exploitation of NetScaler Devices","html":"<iframe width=\"100%\" height=\"180\" frameborder=\"no\" scrolling=\"no\" seamless src=\"https://share.transistor.fm/e/242d38fa\"></iframe>","width":"100%","height":180,"duration":3741,"description":"In this episode, we dissect CitrixBleed 2—a newly disclosed and actively exploited vulnerability affecting Citrix NetScaler ADC and Gateway appliances. Tracked as CVE-2025-5777 (and possibly also CVE-2025-6543), this critical flaw mirrors the notorious original CitrixBleed by allowing attackers to extract sensitive memory content, including user session tokens, through crafted POST login requests.\nDespite Citrix’s claims that there’s no active exploitation, threat intelligence reports from security researchers and government agencies like CISA tell a different story: public proof-of-concept exploits are circulating, and attacks have been observed as early as mid-June. The vulnerability stems from a format string misuse involving the snprintf function, allowing memory leakage in small byte increments—enough for determined attackers to reconstruct sensitive data, hijack authenticated sessions, and potentially access administrative utilities.\nWe cover everything from the technical mechanics of the vulnerability to the strategic mitigation steps enterprises must take. Affected systems include NetScaler MPX, VPX, SDX, and NetScaler Gateway, making the scope of risk widespread, especially in large-scale remote access and cloud deployments.\nIn this episode, we unpack:\nHow CVE-2025-5777 works, including the format string flaw and session token exposure\nIndicators of active exploitation and CISA’s inclusion of related CVEs in its KEV catalog\nThe timeline and evidence suggesting exploitation began weeks before disclosure\nWhy slow patch adoption is increasing risk across industries\nA guided breakdown of the NetScaler Secure Deployment Guide, covering:Strong authentication, MFA, and password security\nRole-based access control (RBAC) and session management\nSecure traffic segmentation, ACL configuration, and TLS hardening\nApp-layer protections like WAF and rewrite policies for cookie security\nLogging, SNMP configuration, and remote syslog best practices\nDNSSEC and...","thumbnail_url":"https://img.transistorcdn.com/pL79_MJFeJHamQ_ztImsGmDSMdl27VMk_30TAkieujE/rs:fill:0:0:1/w:400/h:400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS8yNzg5/ZjlhNzM5Y2M4Njli/NjkxNzgyODA2Nzhi/MDI2ZC5wbmc.webp","thumbnail_width":300,"thumbnail_height":300}