Barracuda Waf Control Center Wcc
Monthly
Authenticated OS command injection in the timezone configuration field of Barracuda Email Security Gateway, Load Balancer ADC, Web Application Firewall, Web Security Gateway, Message Archiver and WAF Control Center allows an administrator-level user to run arbitrary commands as root once the crafted timezone value is processed. The flaw is scored 8.6 under CVSS 4.0 (AV:N/AC:L/PR:H/UI:N with high confidentiality, integrity and availability impact) and was reported by Mandiant, with priority guidance placing remediation in the current week. No public exploit code has been identified at time of analysis, but the companion Barracuda advisory also documents a pre-authentication authorization bypass, so the administrator prerequisite may be removable by chaining and should not be treated as a reliable mitigation.
Authenticated OS command injection in the timezone configuration field of Barracuda Email Security Gateway, Load Balancer ADC, Web Application Firewall, Web Security Gateway, Message Archiver and WAF Control Center allows an administrator-level user to run arbitrary commands as root once the crafted timezone value is processed. The flaw is scored 8.6 under CVSS 4.0 (AV:N/AC:L/PR:H/UI:N with high confidentiality, integrity and availability impact) and was reported by Mandiant, with priority guidance placing remediation in the current week. No public exploit code has been identified at time of analysis, but the companion Barracuda advisory also documents a pre-authentication authorization bypass, so the administrator prerequisite may be removable by chaining and should not be treated as a reliable mitigation.