Rmm
Monthly
Local privilege escalation in Barracuda RMM (all versions prior to 2025.2.2) enables authenticated Windows users to execute arbitrary code as NT AUTHORITY\SYSTEM by writing malicious files to the insecurely-permissioned C:\Windows\Automation directory. Vendor-released patch version 2025.2.2 addresses the filesystem ACL misconfiguration. EPSS data unavailable; no confirmed active exploitation (not in CISA KEV), though VulnCheck public advisory increases likelihood of POC development. CVSS 8.5 reflects high local impact requiring only low-privileged authentication.
Unauthenticated remote attackers can read arbitrary files from Barracuda RMM versions prior to 2025.1.1 by invoking a path-traversal-vulnerable method in the exposed Service Center .NET Remoting service. The assessed impact is high confidentiality loss, with no integrity or availability impact in the independent CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N); escalation to remote code execution is possible only if the attacker can retrieve .NET machine keys and use them to forge trusted payloads, so environments with rotated or protected keys and deployments that do not expose the remoting endpoint are at reduced risk. No public exploit has been identified at time of analysis, and EPSS is 0.75% (54th percentile), indicating low predicted near-term exploitation, making the overall urgency elevated rather than critical.
Unauthenticated remote code execution affects the Barracuda Service Center component of Barracuda RMM in all versions prior to 2025.1.1, where a .NET Remoting endpoint deserializes attacker-supplied type data without adequate restrictions. Per the NVD-assigned CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, all impact metrics High, base score 10.0) and our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), any default installation whose Remoting port is reachable from an untrusted network can be compromised without credentials or user interaction. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this is not confirmed as actively exploited; EPSS is 0.71% (52nd percentile), indicating below-median near-term exploitation likelihood, though the trivial attack prerequisites make the practical risk highly dependent on network exposure of the Service Center endpoint.
Remote code execution in Barracuda RMM's Service Center component (versions prior to 2025.1.1) allows unauthenticated network attackers to run arbitrary code on the server by supplying a malicious WSDL whose service name is not properly validated, enabling insecure reflection into arbitrary method calls or deserialization of untrusted types. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) rates it 10.0, matching our independent CVSS 3.1 assessment of 10.0, meaning remote, unauthenticated, no-interaction exploitation with high confidentiality, integrity, and availability impact on both the vulnerable host and subsequent systems. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is only 0.71% (52nd percentile), so severity is maximum but observed exploitation activity remains low; the primary practical limiter is network reachability of the Service Center endpoint, typically the central management server rather than the managed agents.
Unauthenticated remote code execution in the Barracuda RMM Service Center component (part of the RMM managed-service-provider solution) affects all versions prior to 2025.1.1 and allows an attacker to achieve arbitrary file write and drop a webshell by supplying a crafted WSDL document whose URL the application loads without validation. Per the CVSS vector (PR:N/UI:N/AT:N), no authentication, no user interaction, and no non-default configuration are required - the only practical precondition is network reachability of the Service Center endpoint. Publicly available exploit code exists (WatchTowr's SOAPwn research and a VulnCheck advisory), and EPSS is elevated at 24.72% (98th percentile), though the flaw is not confirmed actively exploited (CISA KEV); the scoring reflects a genuine high-priority risk rather than a high-CVSS-but-low-real-risk case.
Local privilege escalation in Barracuda RMM (all versions prior to 2025.2.2) enables authenticated Windows users to execute arbitrary code as NT AUTHORITY\SYSTEM by writing malicious files to the insecurely-permissioned C:\Windows\Automation directory. Vendor-released patch version 2025.2.2 addresses the filesystem ACL misconfiguration. EPSS data unavailable; no confirmed active exploitation (not in CISA KEV), though VulnCheck public advisory increases likelihood of POC development. CVSS 8.5 reflects high local impact requiring only low-privileged authentication.
Unauthenticated remote attackers can read arbitrary files from Barracuda RMM versions prior to 2025.1.1 by invoking a path-traversal-vulnerable method in the exposed Service Center .NET Remoting service. The assessed impact is high confidentiality loss, with no integrity or availability impact in the independent CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N); escalation to remote code execution is possible only if the attacker can retrieve .NET machine keys and use them to forge trusted payloads, so environments with rotated or protected keys and deployments that do not expose the remoting endpoint are at reduced risk. No public exploit has been identified at time of analysis, and EPSS is 0.75% (54th percentile), indicating low predicted near-term exploitation, making the overall urgency elevated rather than critical.
Unauthenticated remote code execution affects the Barracuda Service Center component of Barracuda RMM in all versions prior to 2025.1.1, where a .NET Remoting endpoint deserializes attacker-supplied type data without adequate restrictions. Per the NVD-assigned CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, all impact metrics High, base score 10.0) and our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), any default installation whose Remoting port is reachable from an untrusted network can be compromised without credentials or user interaction. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this is not confirmed as actively exploited; EPSS is 0.71% (52nd percentile), indicating below-median near-term exploitation likelihood, though the trivial attack prerequisites make the practical risk highly dependent on network exposure of the Service Center endpoint.
Remote code execution in Barracuda RMM's Service Center component (versions prior to 2025.1.1) allows unauthenticated network attackers to run arbitrary code on the server by supplying a malicious WSDL whose service name is not properly validated, enabling insecure reflection into arbitrary method calls or deserialization of untrusted types. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) rates it 10.0, matching our independent CVSS 3.1 assessment of 10.0, meaning remote, unauthenticated, no-interaction exploitation with high confidentiality, integrity, and availability impact on both the vulnerable host and subsequent systems. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is only 0.71% (52nd percentile), so severity is maximum but observed exploitation activity remains low; the primary practical limiter is network reachability of the Service Center endpoint, typically the central management server rather than the managed agents.
Unauthenticated remote code execution in the Barracuda RMM Service Center component (part of the RMM managed-service-provider solution) affects all versions prior to 2025.1.1 and allows an attacker to achieve arbitrary file write and drop a webshell by supplying a crafted WSDL document whose URL the application loads without validation. Per the CVSS vector (PR:N/UI:N/AT:N), no authentication, no user interaction, and no non-default configuration are required - the only practical precondition is network reachability of the Service Center endpoint. Publicly available exploit code exists (WatchTowr's SOAPwn research and a VulnCheck advisory), and EPSS is elevated at 24.72% (98th percentile), though the flaw is not confirmed actively exploited (CISA KEV); the scoring reflects a genuine high-priority risk rather than a high-CVSS-but-low-real-risk case.