PT-2025-50336 · Barracuda Networks · Barracuda Service Center

Piotr Bazydlo · Published 2025-12-10 · Updated 2025-12-23 · CVE-2025-34393

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Barracuda Service Center versions prior to 2025.1.1

Description The Barracuda Service Center, within the RMM solution, improperly validates the name of a WSDL service controlled by an attacker. This insecure reflection can lead to remote code execution through arbitrary method invocation or deserialization of untrusted types.

Recommendations Update Barracuda Service Center to version 2025.1.1 or later.

Fix

RCE

Weakness Enumeration

CWE-470

Related Identifiers

CVE-2025-34393

Affected Products

Barracuda Service Center

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-34393 · Security Note
• https://osv.dev/vulnerability/CVE-2025-34393 · Vendor Advisory
• https://barracuda.com/products/msp/network-protection/rmm · Note
• https://twitter.com/CVEnew/status/2000248644784853033 · Twitter Post
• https://download.mw-rmm.barracudamsp.com/PDF/2025.1.1/RN_BRMM_2025.1.1_EN.pdf · Patch, Vendor Advisory
• https://t.me/cveNotify/146658 · Telegram Post
• https://vulncheck.com/advisories/barracuda-rmm-service-center-insecure-reflection-rce · Note
• https://t.me/CVEtracker/39361 · Telegram Post