Barracuda RMM CVE-2025-34392

No special conditions beyond network reachability of the Barracuda Service Center component: exploitation requires the attacker to submit a crafted WSDL document that the application loads, and the vulnerability stems from the application failing to verify the URL defined within that attacker-controlled WSDL (CWE-36 absolute path traversal). Per the CVSS vector (PR:N/UI:N/AT:N), no authentication, no user interaction, and no non-default configuration are required - any deployment running a version prior to 2025.1.1 with the Service Center exposed is affected. The primary limiting factor is network exposure of the Service Center endpoint; environments that restrict access to the management console reduce reachability. Fixed in version 2025.1.1.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no authentication, no user interaction, and no special attack requirements, with high confidentiality, integrity, and availability impact on both the vulnerable and subsequent systems - yielding the maximum 10.0 score. The description is consistent with this vector: an attacker-controlled WSDL whose embedded URL is not validated leads to arbitrary file write and webshell-based RCE, which is a server-side exploitation path requiring no victim privileges. Supporting signals reinforce the priority: public exploit code exists (watchTowr Labs 'SOAPWN' write-up), and EPSS is 24.72% at the 98th percentile - an unusually high exploitation-probability ranking indicating the flaw is a strong candidate for near-term exploitation. One signal to contrast: this CVE is NOT listed in CISA KEV in the provided data, so despite publicly available exploit code and high EPSS, there is no confirmation of active in-the-wild exploitation yet. The product's role as RMM (remote monitoring and management) software used by MSPs also raises impact, since compromise of a management console can cascade to downstream managed endpoints. SSVC fields were not supplied in the input.

A remote, unauthenticated attacker reaches the Barracuda Service Center over the network and supplies a malicious WSDL referencing an attacker-controlled URL. Because the application loads the WSDL without validating the defined URL, the attacker achieves arbitrary file write and uploads a webshell, gaining remote code execution on the RMM server. Public exploit code for this technique exists (watchTowr Labs 'SOAPWN'), lowering the barrier to weaponization.