Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Multiple Vulnerabilities Found in Citrix SD-WAN Center and SD-WAN Appliances

Tenable Research has discovered multiple critical vulnerabilities in both Citrix SD-WAN Center and the SD-WAN appliance itself that could allow a remote, unauthenticated attacker to compromise the underlying operating systems of each.

  • What you need to know: Tenable Research has disclosed four unauthenticated command injections, an unauthenticated directory traversal and one authenticated command injection in Citrix SD-WAN Center. Tenable Research has also disclosed an unauthenticated SQL injection vulnerability and an authenticated command injection vulnerability which can be used in a chained attack to achieve unauthenticated remote command execution.
  • What’s the attack vector? In the SD-WAN Center, multiple remote code execution (RCE) vulnerabilities can be exploited without authentication to gain root access. In the SD-WAN appliance, an unauthenticated SQL injection can be used to bypass authentication. When combined with an authenticated command injection, an attacker can achieve unauthenticated RCE.
  • What’s the business impact? An attacker could compromise the underlying operating system (OS) of the Citrix SD-WAN Center. The attacker could also exploit some of these vulnerabilities to traverse the target wide-area network (WAN).
  • What’s the solution? Citrix has released patches to address the reported vulnerabilities.


On July 2, Citrix released SD-WAN version 10.2.3 to address multiple vulnerabilities found in Citrix SD-WAN Center and SD-WAN appliance. Tenable has released two research advisories [1, 2] to cover the scope of these vulnerabilities. The first of these advisories includes multiple RCE vulnerabilities found in Citrix SD-WAN Center, while the second includes two vulnerabilities which can be combined to achieve unauthenticated RCE in an SD-WAN appliance. (SD-WAN is both the name of the Citrix product line and a generic term to describe any software-defined wide area network.) These vulnerabilities were discovered by Tenable Researcher Chris Lyne.

Wide area networks are increasingly being managed using software-defined technologies such as Citrix SD-WAN (and others). Adoption of the cloud has created a slew of new challenges for IT management and security as organizations host applications and infrastructure in multiple locations (on-prem, private cloud, public cloud). Many organizations are adopting SD-WAN technology to address the challenges created in today’s complex IT world.

According to a report by CTC Technologies, Citrix SD-WAN ranks in the top 5 SD-WAN vendors for 2019. Citrix SD-WAN Center is a management system which allows enterprises to oversee all SD-WAN appliances on their WAN. According to its customer stories page, Citrix has many notable customers worldwide and across multiple industries.


Tenable discovered multiple critical vulnerabilities (CVSSv2 10.0 Base Score) in SD-WAN Center. These vulnerabilities can be exploited by a remote, unauthenticated attacker to gain root privileges on the OS. Technically speaking, the vulnerabilities are made up of several command injections and a directory traversal in the SD-WAN Center web application. These vulnerabilities can be exploited by a novice attacker.

Tenable has also discovered multiple vulnerabilities in the SD-WAN appliance. These vulnerabilities can also be exploited by a remote, unauthenticated attacker to gain root privileges on the OS.

Citrix has assigned the following CVEs for the six vulnerabilities in Citrix SD-WAN Center:

  • CVE-2019-12985: Unauthenticated Command Injection
  • CVE-2019-12986: Unauthenticated Command Injection
  • CVE-2019-12987: Unauthenticated Command Injection
  • CVE-2019-12988: Unauthenticated Command Injection
  • CVE-2019-12990: Unauthenticated Directory Traversal File Write
  • CVE-2019-12992: Authenticated Command Injection

The vulnerabilities in the Citrix SD-WAN Appliance received the following CVEs:

  • CVE-2019-12989: Unauthenticated SQL Injection
  • CVE-2019-12991: Authenticated Command Injection

Proof of concept

Business impact

Given that organizations would use Citrix SD-WAN to manage their networks across geographical regions, the damage potential is extremely high. An attacker is able to not only compromise the underlying OS of Citrix SD-WAN Center, but also gain administrative access to the application itself. This is true for the SD-WAN appliance as well.

The only requirement is that the attacker must be able to reach an instance of either SD-WAN or SD-WAN Center. This requirement would be determined by how the instance is positioned in a network topology. Consequently, the threat actor could range from an insider threat to an external attacker. The likely threat actor profile would depend on the nature of the organization.

If a successful attack were mounted, it could be devastating to any organization. An attacker would have access to all of the SD-WAN Center application’s functionality. This level of access means an attacker could bring down a specific branch location’s connectivity or even an entire WAN. An attacker could also launch a more fine-tuned attack and make specific configuration changes to the SD-WAN. They could also use these vulnerabilities to traverse from appliance to appliance at will.


Citrix has released a security advisory and patches to address the reported vulnerabilities.

Additional information

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io.

订阅 Tenable 博客

免费试用 立即购买

选择 Tenable.io

免费试用 30 天

可全面访问基于云的现代化漏洞管理平台,从而以无可比拟的精确度发现并追踪所有资产。 立即注册。

立即购买 Tenable.io

可全面访问基于云的现代化漏洞管理平台,从而以无可比拟的精确度发现并追踪所有资产。 立即购买年度订阅。




免费试用 立即购买

免费试用 Nessus Professional

免费试用 7 天

Nessus® 是当今市场上功能最全面的漏洞扫描器。Nessus Professional 可帮助自动化漏洞扫描流程、节省合规周期的时间,并让您调动起 IT 团队的积极性。

购买 Nessus Professional

Nessus® 是当今市场上功能最全面的漏洞扫描器。Nessus Professional 可帮助自动化漏洞扫描流程、节省合规周期的时间,并让您调动起 IT 团队的积极性。

购买多年期许可,即享优惠价格添加高级版支持,获取一年 365 天、一天 24 小时的电话、邮件、社区和聊天支持。完整介绍见此处。

免费试用 立即购买

试用 Tenable.io Web Application Scanning

免费试用 30 天

完整享有专为现代化应用程序而设、属于 Tenable.io 平台组成部分的最新 Web 应用程序扫描功能。可安全扫描全部在线资产组合的漏洞,具有高度准确性,而且无需繁重的手动操作或中断关键的 Web 应用程序。 立即注册。

购买 Tenable.io Web Application Scanning

可全面访问基于云的现代化漏洞管理平台,从而以无可比拟的精确度发现并追踪所有资产。 立即购买年度订阅。




免费试用 联系销售人员

试用 Tenable.io Container Security

免费试用 30 天

完整获得已集成至漏洞管理平台之唯一容器安全产品的功能。监控容器映像中的漏洞、恶意软件和策略违规。与持续集成和持续部署 (CI/CD) 系统进行整合,以支持 DevOps 实践、增强安全性并支持企业政策合规。

购买 Tenable.io Container Security

Tenable.io Container Security 经由与构建流程的集成,可供全面了解容器映像的安全性,包括漏洞、恶意软件和策略违规,借以无缝且安全地启用 DevOps 流程。

了解有关 Industrial Security 的详情

获取 Tenable.sc 演示

请将您的联系方式填写在下方表格中,我们的销售代表很快与您联系安排演示。您也可以写下简短评论(不得超过 255 个字符)。请注意,带星号 (*) 的字段为必填项。

免费试用 联系销售人员

试用 Tenable Lumin

免费试用 30 天

通过 Tenable Lumin 实现对 Cyber Exposure 的直观呈现及探索,长期追踪风险降低状况,并比照同行业者进行基准衡量。

购买 Tenable Lumin

联系销售代表,了解 Lumin 如何帮助您获取整个企业的洞见并管理网络风险。