CVE-2025-34392
Published: 10 December 2025
Description
Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application. This can lead to arbitrary file write and remote…
more
code execution via webshell upload.
Mitigating Controls (NIST 800-53 r5)AI
SI-10 requires validation of information inputs like the attacker-controlled WSDL URL, directly preventing path traversal and arbitrary file writes.
SI-2 mandates identification and remediation of flaws such as this unpatched WSDL verification failure, aligning with the vendor's upgrade advisory.
SI-9 restricts characteristics of inputs like WSDL URLs to approved formats or domains, mitigating exploitation of unverified paths.
Security SummaryAI
CVE-2025-34392 is a critical vulnerability in Barracuda Service Center, a component of the Barracuda RMM solution, affecting versions prior to 2025.1.1. The issue arises because the application fails to verify the URL specified in an attacker-controlled Web Services Description Language (WSDL) file that it later loads. Classified under CWE-36 (Absolute Path Traversal), this flaw allows arbitrary file writes and remote code execution (RCE) via webshell upload. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), highlighting its severity.
Remote attackers can exploit CVE-2025-34392 over the network without authentication, privileges, or user interaction, requiring only low attack complexity. By supplying a malicious WSDL with a controlled URL, an attacker can trick the application into writing files to arbitrary locations, enabling webshell deployment and subsequent RCE on the targeted Barracuda Service Center instance.
Advisories recommend upgrading to Barracuda RMM version 2025.1.1 or later, as outlined in the official release notes. Watchtower Labs provides technical details on the underlying SOAP/WSDL proxy exploitation technique in .NET Framework applications, while Vulncheck's advisory elaborates on the absolute path traversal mechanism leading to RCE in Barracuda Service Center.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables unauthenticated remote exploitation of a public-facing web service (T1190) via path traversal in WSDL, directly facilitating webshell upload for RCE (T1505.003).