# CVE-2019-12989: Citrix - SQLi

> Live exploitation tracking for CVE-2019-12989 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2019-12989

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Citrix NetScaler SD-WAN, Citrix SD-WAN
- **Weaknesses:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
- **Tags:** enterprise_software

## Description

Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.

## CrowdSec analysis

[CVE-2019-12989](https://euvd.enisa.europa.eu/vulnerability/CVE-2019-12989) is a critical vulnerability in Citrix SD-WAN that allows remote attackers to perform SQL injection through a specific configuration endpoint.

CrowdSec has been tracking this vulnerability and its exploits since 15th of December 2023.

CrowdSec network observations suggest that most exploitation of CVE-2019-12989 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2019-12989. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Exploitation attempts are associated with requests targeting URLs containing `/sdwan/nitro/v1/config/get_package_file` and an associated file download action.

## Timeline

- 2019-07-16: CVE Published. CVE-2019-12989 is published to NVD.
- 2022-03-25: CISA KEV. CVE-2019-12989 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2022-04-15: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2023-12-15: Rule Released. CrowdSec releases a rule to detect CVE-2019-12989 exploitation attempts against the CrowdSec Network.
- 2025-03-15: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2019-12989 for the first time.

## References

- https://www.tenable.com/security/research/tra-2019-32

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2019-12989) follows observed exploitation activity for CVE-2019-12989. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.