← Voltar para CVEs
CVE-2025-34392
CRITICAL9.8
Descricao
Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application. This can lead to arbitrary file write and remote code execution via webshell upload.
Detalhes CVE
Pontuacao CVSS v3.19.8
SeveridadeCRITICAL
Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vetor de ataqueNETWORK
ComplexidadeLOW
Privilegios necessariosNONE
Interacao do usuarioNONE
Publicado12/10/2025
Ultima modificacao12/23/2025
Fontenvd
Avistamentos honeypot0
Produtos afetados
barracuda:rmm
Fraquezas (CWE)
CWE-36
Referencias
https://download.mw-rmm.barracudamsp.com/PDF/2025.1.1/RN_BRMM_2025.1.1_EN.pdf(disclosure@vulncheck.com)
https://labs.watchtowr.com/soapwn-pwning-net-framework-applications-through-http-client-proxies-and-wsdl/(disclosure@vulncheck.com)
https://www.barracuda.com/products/msp/network-protection/rmm(disclosure@vulncheck.com)
https://www.vulncheck.com/advisories/barracuda-rmm-service-center-absolute-path-traversal-rce(disclosure@vulncheck.com)
Correlacoes IOC
Sem correlacoes registradas
This product uses data from the NVD API but is not endorsed or certified by the NVD.