CVE-2025-34393

CRITICAL

9.8

Description

Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not correctly verify the name of an attacker-controlled WSDL service, leading to insecure reflection. This can result in remote code execution through either invocation of arbitrary methods or deserialization of untrusted types.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie12/10/2025

Derniere modification12/23/2025

Sourcenvd

Observations honeypot0

Produits affectes

barracuda:rmm

Faiblesses (CWE)

CWE-470

References

https://download.mw-rmm.barracudamsp.com/PDF/2025.1.1/RN_BRMM_2025.1.1_EN.pdf(disclosure@vulncheck.com)

https://www.barracuda.com/products/msp/network-protection/rmm(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/barracuda-rmm-service-center-insecure-reflection-rce(disclosure@vulncheck.com)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.