PT-2025-50335 · Barracuda Networks · Barracuda Service Center

Piotr Bazydlo · Published 2025-12-10 · Updated 2025-12-23 · CVE-2025-34392

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Barracuda Service Center versions prior to 2025.1.1

Description Barracuda Service Center, as implemented in the RMM solution, does not validate the URL specified in a WSDL file controlled by an attacker, which is subsequently loaded by the application. This can result in arbitrary file writing and remote code execution through webshell uploads.

Recommendations Update Barracuda Service Center to version 2025.1.1 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-36

Related Identifiers

CVE-2025-34392

Affected Products

Barracuda Service Center

References · 11

• 🔥 https://labs.watchtowr.com/soapwn-pwning-net-framework-applications-through-http-client-proxies-and-wsdl · Exploit
• https://osv.dev/vulnerability/CVE-2025-34392 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34392 · Security Note
• https://twitter.com/threatintel/status/2003434009385435539 · Twitter Post
• https://download.mw-rmm.barracudamsp.com/PDF/2025.1.1/RN_BRMM_2025.1.1_EN.pdf · Patch, Vendor Advisory
• https://t.me/cveNotify/146657 · Telegram Post
• https://t.me/CVEtracker/39360 · Telegram Post
• https://vulncheck.com/advisories/barracuda-rmm-service-center-absolute-path-traversal-rce · Note
• https://twitter.com/CVEnew/status/2000248645908844673 · Twitter Post
• https://barracuda.com/products/msp/network-protection/rmm · Note
• https://twitter.com/autumn_good_35/status/1999169143996842314 · Twitter Post