CVE-2025-34392: Barracuda RMM < 2025.1.1 Service Center Absolute Path Traversal RCE
Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application. This can lead to arbitrary file write and remote code execution via webshell upload.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Barracuda RMM Service Centerto a version that resolves this vulnerability.Fixed in 2025.1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34392?
CVE-2025-34392 is considered a high severity vulnerability due to the potential for remote code execution.
How do I fix CVE-2025-34392?
To fix CVE-2025-34392, upgrade to Barracuda Service Center version 2025.1.1 or later.
What exploitation techniques are relevant to CVE-2025-34392?
CVE-2025-34392 can be exploited through arbitrary file write and remote code execution via webshell upload.
Which versions of Barracuda Service Center are affected by CVE-2025-34392?
CVE-2025-34392 affects versions of Barracuda Service Center prior to 2025.1.1.
How can CVE-2025-34392 impact my system?
CVE-2025-34392 can lead to unauthorized remote access and control over the affected system.