Vulnerability record · CVE-2019-12989 · published 16 July 2019
CVE-2019-12989: Citrix SD-WAN and NetScaler SD-WAN SQL injection
Citrix · Netscaler Sd Wan
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 are vulnerable to SQL injection. The flaw is remotely reachable without authentication or user interaction, and the record does not specify the exact vulnerable parameter or endpoint.
Description
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with no authentication or interaction required, active KEV listing and very high EPSS probability make this an urgent patch target.
What it is
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 are vulnerable to SQL injection. The flaw is remotely reachable without authentication or user interaction, and the record does not specify the exact vulnerable parameter or endpoint.
Impact
An unauthenticated attacker can inject SQL into the affected interface, potentially reading or modifying backend data and, given the CVSS impact ratings, fully compromising confidentiality, integrity and availability of the appliance.
Attack surface
Reached over the network via the appliance's web-facing interface, per the CVSS vector AV:N/AC:L/PR:N/UI:N; no credentials or user interaction are required. The description does not name the specific vulnerable endpoint or parameter.
Exploitation
CVE-2019-12989 is listed in CISA KEV (added 2022-03-25) and has an EPSS 30-day probability of 0.94131 (99.8th percentile), and references are tagged Exploit, indicating public exploit material exists. No ransomware campaign use is documented.
What to do
- Upgrade Citrix SD-WAN to 10.2.3 or later and NetScaler SD-WAN to 10.0.8 or later per vendor advisory CTX251987.
- If immediate patching is not possible, restrict management and web interface access to trusted networks and disable unnecessary external exposure.
- Monitor vendor advisory CTX251987 for updated fixed versions and interim guidance.
- Review logs and configuration for signs of prior compromise before restoring normal exposure.
Detection
- Inspect web and application logs for SQL metacharacters (quotes, UNION, OR 1=1, comment sequences) in requests to SD-WAN management interfaces.
- Alert on unexpected database queries or errors originating from the appliance's web tier.
- Hunt for anomalous outbound connections or new administrative accounts on SD-WAN appliances.
- Correlate appliance access logs with known exploit tooling user agents or payload patterns.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2019-12989 to the Known Exploited Vulnerabilities catalog on 25 March 2022 as "Citrix SD-WAN and NetScaler SQL Injection Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 15 April 2022.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://packetstormsecurity.com/files/153638/Citrix-SD-WAN-Appliance-10.2.2-Authentication-Bypass-Remote-Command-Executio | ExploitThird Party AdvisoryVDB Entry |
| http://www.securityfocus.com/bid/109133 | Broken LinkThird Party AdvisoryVDB Entry |
| https://support.citrix.com/article/CTX251987 | Vendor Advisory |
| https://www.tenable.com/security/research/tra-2019-32 | ExploitThird Party Advisory |
| http://packetstormsecurity.com/files/153638/Citrix-SD-WAN-Appliance-10.2.2-Authentication-Bypass-Remote-Command-Executio | ExploitThird Party AdvisoryVDB Entry |
| http://www.securityfocus.com/bid/109133 | Broken LinkThird Party AdvisoryVDB Entry |
| https://support.citrix.com/article/CTX251987 | Vendor Advisory |
| https://www.tenable.com/security/research/tra-2019-32 | ExploitThird Party Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-12989 | US Government Resource |
Track CVE-2019-12989 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-12989), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
