Citrix ADC, Gateway vulnerabilities addressed

Security updates have been issued by Citrix to fix three vulnerabilities, including a critical authentication bypass bug, impacting its Application Delivery Controller and Gateway offerings, The Hacker News reports. Threat actors could leverage the flaws, tracked as CVE-2022-27510, CVE-2022-27513, and CVE-2022-27516, to secure authorized accounts, facilitate remote desktop takeovers, and bypass login brute-force attempt defenses provided that the vulnerable Gateway instances are configured as a VPN or as an authentication, authorization and accounting virtual server for CVE-2022-27516. Moreover, setting up the RDP proxy functionality and the "Max Login Attempts" user lockout functionality are required for exploiting CVE-2022-27513 and CVE-2022-27516, respectively. All of the vulnerabilities have been identified and reported by Securitum researcher Jarosaw Jahrek Kamiski. "Affected customers of Citrix ADC and Citrix Gateway are recommended to install the relevant updated versions of Citrix ADC or Citrix Gateway as soon as possible," said Citrix, which added that those depending on Citix-managed cloud services need not act on the flaws.