Barracuda RMM CVE-2025-34393

The specific prerequisite is that the Barracuda RMM Service Center (versions prior to 2025.1.1) processes an attacker-controlled WSDL service name without correctly verifying it, enabling insecure reflection into arbitrary method invocation or untrusted-type deserialization. Per AV:N/AC:L/PR:N/UI:N this is remote unauthenticated exploitation requiring no user interaction against the default-reachable Service Center service; the only effective limiting factors are network reachability of the Service Center endpoint (typically the central management server rather than managed agents) and running a version below 2025.1.1 - upgrading to 2025.1.1 removes the condition.

All severity signals point to maximum theoretical risk: the CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, unauthenticated, low-complexity exploitation with high confidentiality, integrity, and availability impact on both the vulnerable system and subsequent systems (VC/VI/VA:H and SC/SI/SA:H), yielding a 10.0 score. CWE-470 (unsafe reflection) leading to arbitrary method invocation or deserialization of untrusted types is a well-understood, reliable RCE class. However, the exploitation-likelihood signals are notably softer and should temper prioritization: EPSS is only 0.71% (52nd percentile), the CVE is NOT on the CISA KEV list, and no public proof-of-concept is referenced - so this is a high-CVSS flaw without current evidence of active exploitation or public weaponization. The conflict to flag: raw severity is maximal while real-world exploitation probability is currently low/unproven. No SSVC decision data (automatable, exploitation status) was provided in the input, so an SSVC-based priority cannot be computed here. Net assessment - because Barracuda RMM is a privileged management platform whose compromise cascades to all managed endpoints, this warrants prompt patching despite low EPSS; the low EPSS likely reflects limited attacker attention to date rather than low exploitability.

A remote, unauthenticated attacker reaches the Barracuda RMM Service Center over the network and supplies a crafted request referencing an attacker-controlled WSDL service name that the application fails to validate. The insecure reflection resolves this into invocation of arbitrary methods or deserialization of untrusted types, yielding remote code execution on the Service Center host. Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special timing is required; no public exploit code is identified at time of analysis.