Citrix Secure Access - Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges

Successful exploitation of CVE-2025-0320 allows an attacker to bypass standard access controls and execute code with SYSTEM privileges. This grants them unrestricted access to the compromised system, including the ability to install malware, steal sensitive data, modify system configurations, and potentially pivot to other systems on the network. The impact is severe, as it effectively grants the attacker full administrative control. This vulnerability is particularly concerning given the client's role in secure access, potentially allowing attackers to compromise user credentials and network resources.

Organizations heavily reliant on Citrix Secure Access Client for remote access, particularly those with legacy configurations or shared hosting environments, are at increased risk. Systems with weak user privilege management practices are also more vulnerable, as a compromised low-privileged account could be leveraged to escalate privileges.

• windows / supply-chain:

Get-Process citrixsecureaccessclient | Select-Object -ExpandProperty ProcessId

• windows / supply-chain:

Get-WinEvent -LogName Application -FilterXPath "*[System[Provider[@Name='Citrix Secure Access Client']]]" -MaxEvents 10

• windows / supply-chain: Check Autoruns for unusual entries related to Citrix Secure Access Client (using tools like Autoruns from Sysinternals).

1. 2025-06-17Disclosure

   disclosure

1. आरक्षित2025-01-07
2. प्रकाशित2025-06-17
3. संशोधित2026-02-26
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2025-0320 is to upgrade Citrix Secure Access Client for Windows to version 25.5.1.15 or later. Prior to upgrading, it's recommended to back up the system configuration to facilitate rollback if necessary. While a direct workaround isn't available, restricting user privileges and implementing robust network segmentation can limit the potential impact of a successful exploit. Monitor system logs for suspicious activity related to the Citrix Secure Access Client process. After upgrading, confirm the fix by attempting to execute a process with a low-privileged user account and verifying that privilege escalation is prevented.