Barracuda RMM CVE-2025-34395

Exploitation requires network access to the Barracuda Service Center's exposed .NET Remoting service in Barracuda RMM versions prior to 2025.1.1; per CVSS PR:N/UI:N/AC:L no authentication, user interaction, or special timing is needed to perform the arbitrary file read against an exposed instance. The practical limiting factor is reachability of the .NET Remoting endpoint - deployments that firewall or do not expose this service externally sharply reduce exposure. The escalation to RCE is further conditioned on the server using .NET machine keys that, once read, can be abused to forge trusted payloads; environments with rotated or otherwise protected keys, or already upgraded to 2025.1.1+, are not exploitable via this chain.

Signals are moderately consistent but point to elevated-rather-than-critical real-world urgency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H) confirms a network-reachable, low-complexity, unauthenticated flaw affecting confidentiality only in the base metrics - matching the described unauthenticated .NET Remoting path-traversal arbitrary-file-read. The description's claim of escalation to RCE via retrieval of .NET machine keys is NOT reflected in the vendor base vector, which rates VI:N/VA:N; this is a conditional, multi-step escalation rather than a measured direct code-execution impact, so defenders should treat RCE as a realistic consequence but not a single-shot capability. EPSS is low (0.75%, 54th percentile), indicating no broad automated-exploitation signal, and there is NO CISA KEV listing and no POC referenced in the provided data - no public exploit identified at time of analysis. No SSVC decision data was supplied. Net: this is a genuine priority for Barracuda RMM operators (unauthenticated, network, trivial complexity, data exposure leading to potential RCE), but the absence of KEV/POC and the low EPSS argue against imminent mass exploitation. Note the tension worth verifying: the Tags assert 'RCE' while the authoritative base vector scores only confidentiality impact - the RCE is an inferred escalation chain, not an independently confirmed base-metric outcome.

An unauthenticated attacker with network reach to the Barracuda Service Center's exposed .NET Remoting endpoint invokes the vulnerable method with a path-traversal payload to read arbitrary files from the server. The attacker retrieves the ASP.NET machine keys and uses them to forge trusted payloads (e.g., ViewState/deserialization), escalating the file-read into remote code execution. No public exploit code was identified in the provided data, so exploitation currently requires custom development against the Remoting interface.