VulnerabilityAnalyzed
CVE-2025-34392
Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application.
CRITICAL 10.0EPSS 24.7%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 24.7%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application. This can lead to arbitrary file write and remote code execution via webshell upload.
- CVSS 4.0
- 10.0 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 24.72% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-36
- Affected
- barracuda/rmm
- Source
- disclosure@vulncheck.com
References
- https://download.mw-rmm.barracudamsp.com/PDF/2025.1.1/RN_BRMM_2025.1.1_EN.pdfRelease Notes
- https://labs.watchtowr.com/soapwn-pwning-net-framework-applications-through-http-client-proxies-and-wsdl/Exploit, Third Party Advisory
- https://www.barracuda.com/products/msp/network-protection/rmmProduct
- https://www.vulncheck.com/advisories/barracuda-rmm-service-center-absolute-path-traversal-rceThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.