CVE-2025-34392

Critical

Published: 10/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Barracuda Service Center in the RMM solution before version 2025.1.1 does not verify the URL in an attacker-controlled WSDL file that is later loaded by the application. This can lead to arbitrary file write and remote code execution via webshell upload.

Risk Assessment

An attacker can gain full control of the system by executing arbitrary code, compromising confidentiality, integrity, and availability of data.

Recommendation

Update Barracuda Service Center to version 2025.1.1 or later, which includes the fix.

Original NVD description (English source)

Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application. This can lead to arbitrary file write and remote code execution via webshell upload.