Insufficient input validation allows a memory overread when NetScaler ADC or NetScaler Gateway processes packets that contain an enabled TCP TimeStamp flag in a TCP Profile attached to a virtual server or service. The overread may expose internal memory contents, which could reveal sensitive configuration or credential information. This behavior aligns with CWE‑125, a classic memory overread that can lead to information disclosure.

All NetScaler ADC and NetScaler Gateway instances in which the TCP TimeStamp feature is enabled in the TCP Profile and that profile is associated with a virtual server of type LB, CS, or VPN, or with a service. The advisory does not specify affected firmware versions, so the issue is assumed to apply to all current releases available before the cited update.

The CVSS score of 6.9 indicates moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need remote network access and the ability to send traffic that activates the TCP TimeStamp in the target virtual server or service. The description does not confirm any code execution capability; the risk is limited to a potential memory overread that could disclose data.