Skip to content
arrow-alt-circle-up icon

Cyber Incident?

arrow-alt-circle-up icon

Call 00800 1744 0000

arrow-alt-circle-up icon

Dutch follows English

 

On June 17 2025, Citrix published an advisory regarding two vulnerabilities [1]. Two critical vulnerabilities in NetScaler ADC and NetScaler Gateway appliances allow attackers to gain unauthorized access to certain parts of the system and lead to an Out-of-bounds Read. We previously emailed you about these vulnerabilities and the advice to apply the patch quickly. Since then, these vulnerabilities have been abused at scale both by nation-state actors and by other actors. If you did not patch in time, you can assume your devices have been compromised and you should act accordingly.

 

Description 

On June 17, Citrix published on the vulnerabilities in their products and made patches available. As early as June 20, a threat actor that is presumably a Chinese nation-state actor started exploiting the vulnerability in a targeted way [2]. On July 4, a public proof-of-concept exploit was published, that enabled everybody to develop exploits and scanners. Since then, numerous actors have exploited the vulnerability, and threat intel providers have used this exploitation to retro-actively spot exploitation prior to July 4, resulting in the intelligence on Chinese actors.

Impact 

The impact of this vulnerability is high: it allows attackers to obtain valid session tokens and hijack existing sessions, or setup new sessions with the privileges of the users associated with the stolen tokens. Exploitation is not trivial but not too hard either.

Risk 

If you did not patch your vulnerable Netscalers prior to July 4, you should assume they have been compromised. If you did not patch your vulnerable Netscalers prior to June 20 and you are potentially of interest to Chinese nation state actors, you should investigate under the assumption of compromise.
 

Mitigation 

Follow the patching advice previously described in our TR [3].

What should you do? 

If you have not patched your vulnerable Netscaler devices yet, we recommend taking them offline directly and investigating compromise of the devices and the IT they give access to. The likelihood of compromise is high at this point, and attackers who gain access through these Netscaler devices will most likely have access to systems behind that for some time now.

If you patched after June 20, we recommend that you investigate your logs for signs of compromise using published indicators [4]. Additionally, you can search for a mismatch between the IP address that started a user session and the IP address from which user sessions were used. This mismatch is an indication of a session being hijacked by an attacker.

If you spot anomalies in IP addresses in this way, or if you find signs of compromise using the recommended searches [4], we recommend that you contact our CERT for an investigation into a possible breach.

 

What will Northwave do? 

Vulnerability Management customers will be informed in case vulnerable systems are detected in their infrastructure.  

We will monitor any developments regarding this vulnerability. If new critical information about this threat arises we will reach out to you. You can call us by phone or send us an email if you would like additional information. 

 
E-mail: soc@northwave-cybersecurity.com
Do you have an incident right now? Call our Incident Response Team: 00800 1744 0000
 

Disclaimer applies, see below. 

Sources 

[1]: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420  

[2]: https://doublepulsar.com/citrixbleed-2-situation-update-everybody-already-got-owned-503c6d06da9f

[3]: https://northwave-cybersecurity.com/threat-response-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway

[4]: https://doublepulsar.com/citrixbleed-2-exploitation-started-mid-june-how-to-spot-it-f3106392aa71

 

Disclaimer applies, see below. 

Sources 

[1]: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6

[2]: https://advisories.ncsc.nl/advisory?id=NCSC-2025-0204

 

 

Dutch follows English 
 
This is an update to our Threat Response sent on the 27th of August 2024 regarding a vulnerability (CVE-2024-40766) in SonicOS. 
 
In addition to our previous Threat Response, we want to bring your attention to a number of developments. 

Dear Reader, 
 
On 22 August 2024, SonicWall warned[1] about a critical vulnerability CVE-2024-40766 in the SonicOS operating system, used in their line of network security products. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 or older versions. The vulnerability receives a CVSS v3 score of 9.3. 
 
On 7 August 2025, SonicWall published an update about their ongoing investigation into the above-mentioned incidents involving Gen 7 and newer firewalls with SSLVPN enabled[2]. 
 
Northwave's Computer Emergency Response Team (NW-CERT) as well as other incident response organisations have already observed exploitation of this vulnerability in recent (ransomware) incidents. We're sending you this Threat Response Update because this vulnerability requires immediate action if you run affected SonicWall products. 
 
Description 
Many of the incidents relate to migrations from Gen 6 to Gen 7 firewalls, where local user passwords were carried over during the migration and not reset. Resetting passwords was a critical step outlined in the original advisory[3]. 
 
To ensure full protection, SonicWall strongly urges customers who have imported configurations from Gen 6 to newer firewalls to take the following steps immediately: 
  • Update firmware to version 7.3.0, which includes enhanced protections against brute force attacks and additional MFA controls. 
  • Reset all local user account passwords for any accounts with SSLVPN access, especially if they were carried over during migration from Gen 6 to Gen 7.  
  • Continue applying the previously recommended best practices: 
    • Enable Botnet Protection and Geo-IP Filtering.  
    • Remove unused or inactive user accounts.  
    • Enforce MFA and strong password policies. 
Next to this, Huntress recommends resetting LDAP accounts used for Active Directory integration[4]. 
 
Impact 
We estimate the impact of these vulnerabilities as HIGH because the successful exploitation of these vulnerabilities could result in unauthorised access to a security device. This unauthorised access can result in an attacker manipulating or accessing your network traffic, or can serve as a stepping stone for an attacker to other systems. 
 
Risk 
We estimate the risk of these vulnerabilities as HIGH, as there are reports of active exploitation of one of the vulnerabilities. The primary risk associated with this vulnerability is unauthorised access to your environment, potentially leading to lateral movement. 
 
Mitigation 
SonicWall has published updates to remediate the vulnerability. Northwave recommends upgrading your SonicOS devices using the latest updates and resetting all local user passwords. To minimise potential impact, restrict firewall management access to trusted sources or disable firewall WAN management access from internet sources. In case upgrading is not possible (swiftly), this measure will also limit exposure of this vulnerability until a patch can be applied. 
 
What should you do? 
Upgrade you SonicOS devices, reset all local user passwords and LDAP accounts, and restrict management access where not done so yet. 
 
What will Northwave do? 
We will monitor any developments regarding this vulnerability. If new critical information about this threat arises we will reach out to you. You can send us an email if you would like additional Information.

E-mail: soc@northwave-cybersecurity.com
Do you have an incident right now? Call our Incident Response Team: 00800 1744 0000 

Disclaimer applies, see below. 

Sources 
Op 22 Augustus 2024 waarschuwde[1] SonicWall  voor een kritieke kwetsbaarheid  CVE-2024-40766 in het SonicOS besturingssysteem, gebruikt in hun lijn van netwerksecurity producten. Deze kwetsbaarheid betreft zowel SonicWall Firewall Gen 5 and Gen 6 apparten, als  Gen 7 apparaten die SonicOS 7.0.1-5035 of ouder gebruiken. De kwetsbaarheid heeft een CVSS v3 score van 9.3 gekregen. 
 
Op 7 augustus 2025 publiceerde SonicWall een update over hun lopend onderzoek naar de hierboven genoemde incidenten met betrekking tot Gen 7 en nieuwere firewalls waarbij SSLVPN is ingeschakeld [2]. 
 
Het Northwave Computer Emergency Response Team (NW-CERT) en andere incident response organisaties hebben reeds kennis genomen van misbruik van deze kwetsbaarheid in recente (ransomware) incidenten. Wij sturen U deze Threat Response Update omdat deze kwetsbaarheid onmiddelijke actie vereist indien er gebruikt wordt gemaakt van een kwetsbaar SonicOS apparaat. 
 
Beschrijving 
Veel van de incidenten houden verband met migraties van Gen 6 naar Gen 7 firewalls, waarbij lokale gebruikerswachtwoorden zijn meegenomen tijdens de migratie en niet zijn gereset. Het resetten van wachtwoorden was een cruciale stap zoals vermeld in het oorspronkelijke advies[3]. 
 
Om volledige bescherming te garanderen, dringt SonicWall er sterk op aan dat klanten die configuraties hebben geïmporteerd van Gen 6 naar nieuwere firewalls onmiddellijk de volgende stappen ondernemen: 
  • Werk de firmware bij naar versie 7.3.0, die verbeterde bescherming biedt tegen brute force-aanvallen en extra MFA-controles bevat. 
  • Reset alle wachtwoorden van lokale gebruikersaccounts met SSLVPN-toegang, vooral als deze zijn meegenomen tijdens de migratie van Gen 6 naar Gen 7. 
  • Blijf de eerder aanbevolen best practices toepassen: 
    • Schakel Botnetbescherming en Geo-IP-filtering in. 
    • Verwijder ongebruikte of inactieve gebruikersaccounts. 
    • Handhaaf MFA en sterke wachtwoordbeleid. 
Daarnaast raadt Huntress aan om de LDAP-accounts die worden gebruikt voor de Active Directory-integratie te resetten[4]. 
 
Impact 
Wij schatten de impact van exploitatie van deze kwetsbaarheden in als HOOG omdat succesvolle uitbuiting van deze kwetsbaarheden kan resulteren in ongeautoriseerd toegang tot een netwerkbeveiligingsapparaat. Deze ongeautoriseerde toegang kan leiden tot manipulatie of inzage in netwerkverkeer of kan gebruikt worden als opstap in een aanval op andere systemen. 
 
Risico 
Wij schatten het risico van deze kwetsbaarheden in als HOOG aangezien er gemeld wordt dat de kwetsbaarheden actief worden uitgebuit. De primaire risico’s van deze kwetsbaarheden zijn ungeautoriseerde toegang tot uw netwerk en laterale beweging. 
 
Mitigatie 
SonicWall heeft updates gepubliceerd om de kwetsbaarheid te verhelpen. Northwave raadt aan om de SonicOS-apparaten te upgraden met de nieuwste updates en alle lokale gebruikerswachtwoorden te resetten. Om mogelijke impact te minimaliseren, beperk de toegang tot firewallbeheer tot vertrouwde bronnen of schakel WAN-beheer via internet uit. Als upgraden (snel) niet mogelijk is, zal deze maatregel ook de blootstelling aan deze kwetsbaarheid beperken totdat een patch kan worden toegepast. 
 
Wat moet u doen? 
Update uw SonicOS apparaten, reset alle wachtwoorden van lokale gebruikersaccounts en mogelijk gerelateerde LDAP-accounts en beperk management toegang waar van toepassing. 
 
Wat doet Northwave? 
Northwave houdt de ontwikkelingen omtrent deze kwetsbaarheid in de gaten. Als er belangrijke nieuwe informatie omtrent deze dreiging bekend wordt, stellen wij u hiervan op de hoogte. 

E-mail: soc@northwave-cybersecurity.com
Heeft u nu een incident? Bel ons Incident Response Team: 00800 1744 0000  
  
Disclaimer is van toepassing, zie onder. 
 
Bronnen 

 

 

Disclaimer

Northwave has made every effort to make this information accurate and reliable. However, the information provided is without warranty of any kind and its use is at the sole risk of the user. Northwave does not accept any responsibility or liability for the accuracy, content, completeness, legality or reliability of the information provided. We will not be liable for any loss or damage of whatever nature, direct or indirect, consequential or other, whether arising in contract, tort or otherwise, which may arise as a result of your use of, or inability to use, this information or any additional information provided by us in direct or indirect relation to the information provided here.
 
.