PRP: Detector for NetScaler ADC / Gateway CVE-2025-7775

[0xXA]

• Identifier of the vulnerability: CVE-2025-7775
• Affected software: Netscaler ADC / Gateway
• Type of vulnerability: Memory overflow vulnerability / Remote Code Execution
• Resources:
  • CVE-2025-7775

[github-actions]

Welcome to the OSV-SCALIBR patch reward program!
Your issue has been added to our triage queue and will reviewed
shortly. The panel usually takes a decision once per week, so it
can take up to a week before you hear back from us.
Please, do not start the work until the panel has reached a
decision. Although we always welcome contributions, unapproved
work is not eligible for a reward.
~The OSV-SCALIBR PRP team

[github-actions]

This message is addressed to the OSV-SCALIBR panel.

Contributor stats

• The contributor has 0 issues tagged as main;
• The contributor has 0 issues tagged as queue.

Useful links

• All open issues from this contributor
• All open PRs from this contributor

[0xXA]

Hi @erikvarga,

Netscaler ships VMs in .ova/.qcow/.vhdx/.vhd/vdi/.vmdk. CVE-2025-7775 (CVSS 9.2) can be detected after .ova and these disk image parsers have done their work. We can then make a detector for this Vulnerability by scanning for vulnerabile version in /netscaler/ns_config file.

I don't know if it qualifies for emergent Vulnerability in OSV-SCALIBR.
I would like to hear your thoughts.

Btw, both CVE-2025-7775 and CVE-2025-7776 #1246 are published less than a week ago.

[erikvarga]

What would an e2e attack flow look like for this vulnerability? I see the CVE describes a vuln that can lead to Remote Code Execution. Can a remote attacker trigger an RCE using this CVE? Do they need authenticatation or anything similar?

[0xXA]

What would an e2e attack flow look like for this vulnerability? I see the CVE describes a vuln that can lead to Remote Code Execution. Can a remote attacker trigger an RCE using this CVE? Do they need authenticatation or anything similar?

A remote attacker can scan for NetScaler ADC/Gateway instances exposed to the Internet, fingerprint the version/build via HTTPS banners or files, and then send specially crafted requests to the Gateway or AAA virtual server endpoints. If the appliance is running an affected version and those features are enabled, the vulnerability can be triggered to cause memory corruption. Successful exploitation leads to remote code execution, after which the attacker can install a backdoor or pivot inside the network. No authentication is needed. The NetScaler needs to be configured as a Gateway (proxy) or AAA virtual server and the vulnerable code path is exposed. It was a 0-day Vulnerability and was being exploited since early May. No public exploit available but hackers are actively exploiting it.

https://www.rapid7.com/blog/post/etr-cve-2025-7775-critical-netscaler-vulnerability-exploited-in-the-wild/