id: CVE-2025-7775

info:
  name: "Citrix - Memory Corruption"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and
    NetScaler Gateway when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or
    AAA virtual server (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual
    servers of type (HTTP, SSL or HTTP_QUIC) bound with IPv6 services or servicegroups bound with IPv6 servers
    (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2025-7775&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=citrix&match=exact
  classification:
    cve-id: CVE-2025-7775
  metadata:
    verified: false
  tags: cve,cve2025,kev,citrix,netscaler,memory-corruption,rce,zero-day
http:
  - method: GET
    path:
      - "{{BaseURL}}/logon/LogonPoint/receiver/images/common/icon_vpn.ico"

    extractors:
      - type: kval
        name: date
        part: header
        kval:
          - last_modified
  
      - type: dsl
        name: last_modified_ts
        dsl:
          - to_unix_time(date, "Mon, 02 Jan 2006 15:04:05 MST")
        internal: true
    
    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - status_code==200 && mmh3(body)=="1418494345"

      - type: dsl
        dsl:
          - compare_versions(last_modified_ts, "< 1756166400")