{“lastseen”:”2026-02-02T17:40:25″,”description”:”This Metasploit module scans for vulnerable Citrix NetScaler ADC instances affected by the memory overflow noted in CVE-2025-6543. It identifies vulnerable versions through SNMP and SSH banner grabbing…”,”published”:”2026-02-02T00:00:00″,”modified”:”2026-02-02T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 NetScaler 13.1 Vulnerability Scanner”,”source”:””,”references”:””,”id”:”PACKETSTORM:214698″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-6543″],”sourceData”:”=============================================================================================================================================\\n | # Title : NetScaler 13.1 Vulnerability Scanner |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.1 (64 bits) |\\n | # Vendor : https:\/\/www.netscaler.com\/ |\\n =============================================================================================================================================\\n \\n POC : \\n \\n [+] References : https:\/\/packetstorm.news\/files\/id\/212005\/ \\u0026 CVE-2025-6543\\n \\n \\n [+] Summary :\\n \\n This module scans for vulnerable Citrix NetScaler (ADC) instances affected by CVE-2025-6543.\\n It identifies vulnerable versions through SNMP and SSH banner grabbing.\\n \\n \\n [+] Usage :\\n \\n msf6 \\u003e use auxiliary\/scanner\/netscaler\/cve_2025_6543\\n \\n msf6 \\u003e set RHOSTS 192.168.1.0\/24\\n \\n msf6 \\u003e set THREADS 10\\n \\n msf6 \\u003e run\\n \\n [+] POC :\\n \\n ##\\n # Module: auxiliary\/scanner\/netscaler\/cve_2025_6543\\n # Version: 1.0\\n # Author: indoushka\\n ##\\n \\n require ‘msf\/core’\\n \\n class MetasploitModule \\u003c Msf::Auxiliary\\n include Msf::Exploit::Remote::SNMPClient\\n include Msf::Auxiliary::Scanner\\n include Msf::Auxiliary::Report\\n \\n def initialize(info = {})\\n super(update_info(info,\\n ‘Name’ =\\u003e ‘Citrix NetScaler CVE-2025-6543 Vulnerability Scanner’,\\n ‘Description’ =\\u003e %q{\\n This module scans for vulnerable Citrix NetScaler (ADC) instances affected by CVE-2025-6543.\\n It identifies vulnerable versions through SNMP and SSH banner grabbing.\\n },\\n ‘Author’ =\\u003e [‘indoushka’],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2025-6543’],\\n [‘URL’, ‘https:\/\/support.citrix.com\/article\/CTXxxxxxx\/netscaler-security-update’]\\n ],\\n ‘DisclosureDate’ =\\u003e ‘2025-11-26’\\n ))\\n \\n register_options([\\n OptString.new(‘COMMUNITY’, [true, ‘SNMP community string’, ‘public’]),\\n OptString.new(‘SSH_USER’, [false, ‘SSH username’]),\\n OptString.new(‘SSH_PASS’, [false, ‘SSH password’]),\\n OptPort.new(‘SSH_PORT’, [true, ‘SSH port’, 22]),\\n OptBool.new(‘USE_SNMP’, [true, ‘Use SNMP for detection’, true]),\\n OptBool.new(‘USE_SSH’, [true, ‘Use SSH for detection’, false]),\\n OptPath.new(‘RHOSTS_FILE’, [false, ‘File containing list of targets’]),\\n OptBool.new(‘EXPLOIT_CHECK’, [true, ‘Perform basic exploit validation’, false])\\n ])\\n \\n deregister_options(‘VERSION’) # SNMP version handled internally\\n end\\n \\n # Safe builds mapping\\n SAFE_BUILDS = {\\n ‘14.1’ =\\u003e [47, 46],\\n ‘13.1’ =\\u003e [59, 19],\\n ‘13.1FIPS’ =\\u003e [37, 235],\\n ‘13.1NDCPP’ =\\u003e [37, 236],\\n ‘12.1’ =\\u003e [55, 328]\\n }.freeze\\n \\n def run_host(ip)\\n # Check SNMP if enabled\\n if datastore[‘USE_SNMP’]\\n check_snmp(ip)\\n end\\n \\n # Check SSH if enabled and credentials provided\\n if datastore[‘USE_SSH’] \\u0026\\u0026 datastore[‘SSH_USER’] \\u0026\\u0026 datastore[‘SSH_PASS’]\\n check_ssh(ip)\\n end\\n end\\n \\n def check_snmp(ip)\\n begin\\n connect_snmp\\n \\n # SNMP OID for system description\\n oid = ‘1.3.6.1.2.1.1.1.0’\\n response = snmp.get_value(oid)\\n \\n if response\\n vprint_status(\\”#{ip} – SNMP Response: #{response}\\”)\\n process_banner(ip, response, ‘SNMP’)\\n else\\n vprint_error(\\”#{ip} – No SNMP response received\\”)\\n end\\n \\n rescue ::SNMP::RequestTimeout, ::SNMP::UnsupportedVersion =\\u003e e\\n vprint_error(\\”#{ip} – SNMP error: #{e.class} – #{e.message}\\”)\\n rescue ::Exception =\\u003e e\\n vprint_error(\\”#{ip} – SNMP connection failed: #{e.class} – #{e.message}\\”)\\n ensure\\n disconnect_snmp\\n end\\n end\\n \\n def check_ssh(ip)\\n begin\\n # Create SSH connection\\n ssh_opts = {\\n port: datastore[‘SSH_PORT’],\\n auth_methods: [‘password’, ‘keyboard-interactive’],\\n password: datastore[‘SSH_PASS’],\\n non_interactive: true,\\n config: false,\\n verbose: :error\\n }\\n \\n ::Timeout.timeout(10) do\\n ssh = Net::SSH.start(ip, datastore[‘SSH_USER’], ssh_opts)\\n \\n # Execute version command\\n version_output = ssh.exec!(‘show version | head -n 10’)\\n vprint_status(\\”#{ip} – SSH Response: #{version_output}\\”)\\n \\n process_banner(ip, version_output, ‘SSH’)\\n ssh.close\\n end\\n \\n rescue ::Timeout::Error\\n vprint_error(\\”#{ip} – SSH connection timeout\\”)\\n rescue Net::SSH::AuthenticationFailed\\n vprint_error(\\”#{ip} – SSH authentication failed\\”)\\n rescue ::Exception =\\u003e e\\n vprint_error(\\”#{ip} – SSH connection failed: #{e.class} – #{e.message}\\”)\\n end\\n end\\n \\n def process_banner(ip, banner, method)\\n # Parse NetScaler version from banner\\n version_info = parse_netscaler_version(banner)\\n \\n return unless version_info\\n \\n branch = version_info[:branch]\\n build_major = version_info[:build_major]\\n build_minor = version_info[:build_minor]\\n tag = version_info[:tag]\\n \\n full_branch = branch + tag\\n build = [build_major, build_minor]\\n \\n # Check if vulnerable\\n vulnerable = is_vulnerable?(full_branch, build)\\n \\n # Report findings\\n if vulnerable\\n print_good(\\”#{ip} – VULNERABLE \ufe0f – #{full_branch} #{build_major}.#{build_minor} via #{method}\\”)\\n \\n # Report vulnerability\\n report_vuln(\\n host: ip,\\n name: ‘Citrix NetScaler CVE-2025-6543’,\\n refs: references,\\n info: \\”Vulnerable NetScaler version detected: #{full_branch} #{build_major}.#{build_minor}\\”\\n )\\n \\n # Perform exploit check if requested\\n if datastore[‘EXPLOIT_CHECK’]\\n exploit_check(ip)\\n end\\n \\n else\\n print_status(\\”#{ip} – PATCHED – #{full_branch} #{build_major}.#{build_minor} via #{method}\\”)\\n end\\n \\n # Report service information\\n report_service(\\n host: ip,\\n port: method == ‘SNMP’ ? 161 : datastore[‘SSH_PORT’],\\n proto: ‘tcp’,\\n name: method.downcase,\\n info: \\”NetScaler #{full_branch} #{build_major}.#{build_minor}\\”\\n )\\n end\\n \\n def parse_netscaler_version(banner)\\n # Regex to match NetScaler version patterns\\n patterns = [\\n \/NetScaler.*?(?\\u003cbranch\\u003e\\\\d+\\\\.\\\\d+)[-_](?\\u003cmajor\\u003e\\\\d+)\\\\.(?\\u003cminor\\u003e\\\\d+)(?:[-_](?\\u003ctag\\u003eFIPS|NDCPP))?\/i,\\n \/NS.*?(?\\u003cbranch\\u003e\\\\d+\\\\.\\\\d+)[-_](?\\u003cmajor\\u003e\\\\d+)\\\\.(?\\u003cminor\\u003e\\\\d+)(?:[-_](?\\u003ctag\\u003eFIPS|NDCPP))?\/i,\\n \/Version:\\\\s*(?\\u003cbranch\\u003e\\\\d+\\\\.\\\\d+).*?Build:\\\\s*(?\\u003cmajor\\u003e\\\\d+)\\\\.(?\\u003cminor\\u003e\\\\d+)\/i\\n ]\\n \\n patterns.each do |pattern|\\n match = banner.match(pattern)\\n next unless match\\n \\n return {\\n branch: match[:branch],\\n build_major: match[:major].to_i,\\n build_minor: match[:minor].to_i,\\n tag: match[:tag] || ”\\n }\\n end\\n \\n vprint_error(\\”Could not parse NetScaler version from: #{banner[0,100]}…\\”)\\n nil\\n end\\n \\n def is_vulnerable?(branch, build)\\n safe_build = SAFE_BUILDS[branch]\\n return true unless safe_build # Unknown branch, assume vulnerable\\n \\n # Compare builds\\n build[0] \\u003c safe_build[0] || (build[0] == safe_build[0] \\u0026\\u0026 build[1] \\u003c safe_build[1])\\n end\\n \\n def exploit_check(ip)\\n vprint_status(\\”#{ip} – Performing exploit validation…\\”)\\n \\n # Basic connectivity checks for potential exploitation\\n checks = [\\n { port: 80, service: ‘HTTP Management’ },\\n { port: 443, service: ‘HTTPS Management’ },\\n { port: 3010, service: ‘MIP Management’ },\\n { port: 3008, service: ‘Python Management’ }\\n ]\\n \\n checks.each do |check|\\n if port_open?(ip, check[:port])\\n vprint_status(\\”#{ip} – #{check[:service]} accessible on port #{check[:port]}\\”)\\n end\\n end\\n \\n # Report potential exploitation vector\\n report_note(\\n host: ip,\\n type: ‘netscaler.cve_2025_6543.vulnerable’,\\n data: ‘Vulnerable NetScaler instance identified for CVE-2025-6543’\\n )\\n end\\n \\n def port_open?(ip, port, timeout = 3)\\n begin\\n socket = Rex::Socket::Tcp.create(\\n ‘PeerHost’ =\\u003e ip,\\n ‘PeerPort’ =\\u003e port,\\n ‘Timeout’ =\\u003e timeout\\n )\\n socket.close\\n return true\\n rescue\\n return false\\n end\\n end\\n \\n def run\\n # Load targets from file if specified\\n if datastore[‘RHOSTS_FILE’] \\u0026\\u0026 File.exist?(datastore[‘RHOSTS_FILE’])\\n hosts = File.readlines(datastore[‘RHOSTS_FILE’]).map(\\u0026:strip).reject(\\u0026:empty?)\\n hosts.each { |host| run_host(host) }\\n else\\n super\\n end\\n end\\n end\\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/214698″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/214698\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-02T17:40:25″,”description”:”This Metasploit module scans for vulnerable Citrix NetScaler ADC instances affected by the memory overflow noted in CVE-2025-6543. It identifies vulnerable versions through SNMP and…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,13,53,7,11,5],"class_list":["post-38553","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n