PT-2025-50338 · Barracuda Networks · Barracuda Service Center

Piotr Bazydlo · Published 2025-12-10 · Updated 2025-12-23 · CVE-2025-34395

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Barracuda Service Center versions prior to 2025.1.1

Description The Barracuda Service Center, as part of the RMM solution, has a .NET Remoting service exposed that allows an unauthenticated attacker to invoke a method susceptible to path traversal, enabling the reading of arbitrary files. This can be further exploited to achieve remote code execution by obtaining the .NET machine keys.

Recommendations Update Barracuda Service Center to version 2025.1.1 or later.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-34395

Affected Products

Barracuda Service Center

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-34395 · Security Note
• https://osv.dev/vulnerability/CVE-2025-34395 · Vendor Advisory
• https://download.mw-rmm.barracudamsp.com/PDF/2025.1.1/RN_BRMM_2025.1.1_EN.pdf · Patch, Vendor Advisory
• https://t.me/CVEtracker/39363 · Telegram Post
• https://vulncheck.com/advisories/barracuda-rmm-service-center-net-remoting-path-traversal-rce · Note
• https://twitter.com/CVEnew/status/2000248642456961504 · Twitter Post
• https://barracuda.com/products/msp/network-protection/rmm · Note
• https://t.me/cveNotify/146660 · Telegram Post