Barracuda Email Security Gateway Esg
Monthly
Unauthenticated remote attackers can bypass authentication in Barracuda Email Security Gateway (ESG) deployments earlier than 9.4.0.030 and reach the configuration-import function, where restoring a crafted but compatible backup archive modifies the appliance's global configuration. The flaw is rated CVSS 9.3 and an independent assessment scores it CVSS:3.1 9.8 with network-only, no-credential access; the only stated prerequisite is a backup archive compatible with the target firmware. No public exploit code was identified in the available sources at time of analysis, but the act_now priority and Mandiant reporting make prompt upgrade to 9.4.0.030 the appropriate response.
Authenticated OS command injection in the timezone configuration field of Barracuda Email Security Gateway, Load Balancer ADC, Web Application Firewall, Web Security Gateway, Message Archiver and WAF Control Center allows an administrator-level user to run arbitrary commands as root once the crafted timezone value is processed. The flaw is scored 8.6 under CVSS 4.0 (AV:N/AC:L/PR:H/UI:N with high confidentiality, integrity and availability impact) and was reported by Mandiant, with priority guidance placing remediation in the current week. No public exploit code has been identified at time of analysis, but the companion Barracuda advisory also documents a pre-authentication authorization bypass, so the administrator prerequisite may be removable by chaining and should not be treated as a reliable mitigation.
Unauthenticated remote attackers can bypass authentication in Barracuda Email Security Gateway (ESG) deployments earlier than 9.4.0.030 and reach the configuration-import function, where restoring a crafted but compatible backup archive modifies the appliance's global configuration. The flaw is rated CVSS 9.3 and an independent assessment scores it CVSS:3.1 9.8 with network-only, no-credential access; the only stated prerequisite is a backup archive compatible with the target firmware. No public exploit code was identified in the available sources at time of analysis, but the act_now priority and Mandiant reporting make prompt upgrade to 9.4.0.030 the appropriate response.
Authenticated OS command injection in the timezone configuration field of Barracuda Email Security Gateway, Load Balancer ADC, Web Application Firewall, Web Security Gateway, Message Archiver and WAF Control Center allows an administrator-level user to run arbitrary commands as root once the crafted timezone value is processed. The flaw is scored 8.6 under CVSS 4.0 (AV:N/AC:L/PR:H/UI:N with high confidentiality, integrity and availability impact) and was reported by Mandiant, with priority guidance placing remediation in the current week. No public exploit code has been identified at time of analysis, but the companion Barracuda advisory also documents a pre-authentication authorization bypass, so the administrator prerequisite may be removable by chaining and should not be treated as a reliable mitigation.