Citrix SD-WAN 4000 Firmware vulnerabilities

3 CVEs affecting Citrix SD-WAN 4000 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-2049, published 2024-03-12.

More from Citrix.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-27506, published 2022-04-13. Low severity, CVSS 2.7. EPSS: 0.7% chance of exploitation in the next 30 days. Hard-coded credentials allow administrators to access the shell via the SD-WAN CLI
• CVE-2022-27505, published 2022-04-13. Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days. Reflected cross site scripting (XSS)
• CVE-2024-2049, published 2024-03-12. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. Server-Side Request Forgery (SSRF) in Citrix SD-WAN Standard/Premium Editions on or after 11.4.0 and before 11.4.4.46 allows an attacker to disclose limited information from the appliance via Access…