Citrix CVE-2025-6543

Script to check if Citrix is vulnerable to CVE-2025-6543

citrix-cve-2025-6543-check.py is a Python 3 command-line script that identifies NetScaler ADC / Gateway instances vulnerable to the CVE-2025-6543 memory overflow published by Citrix in June 2025. Designed for pentesters and response teams of Grupo Oruss, it allows quick verification of production or lab environments (only with prior authorization).

Main features

Feature Detail

Remote detection Reads the appliance version via SNMP v2c (sysDescr.0) or, optionally, by executing show version over SSH. Smart comparison Evaluates the branch and build number against the table of official patched versions (14.1-47.46, 13.1-59.19, 13.1-37.236-FIPS/NDcPP). Readable output Clearly shows whether the host is VULNERABLE or Patched, including the detection method (SNMP/CLI). Modular usage Supports multiple hosts in a single command and allows disabling SNMP or SSH according to the exposed surface. No heavy dependencies Only needs Python 3, snmpget (Net-SNMP), and sshpass for the SSH path.

Ethics and legal framework

The script should only be used on assets that: Belong to you or your organization or Are covered by a penetration testing contract with explicit consent from the owner. Unauthorized use may violate local and international laws.

Grupo Oruss and the authors assume no responsibility for misuse.

Published under the MIT License (see LICENSE).

Stay secure — and happy hunting.

— Joy Bassett (@oruss_joy), Grupo Oruss