SecurityWeek reports Barracuda ESG auth bypass and command injection can chain to root
SecurityWeek reports that an authentication bypass and a command injection flaw can be chained to gain root access on Barracuda's Email Security Gateway appliances. The item does not provide CVE identifiers, a patch status, or evidence that the flaws have been exploited.
Written by a model from the sources below. Verify against them.
- Kind
- Vulnerability
- Vendor
- Barracuda
- Product
- Email Security Gateway
- Status
- Reported, not confirmed
- First seen
What to do
Check Barracuda's security advisories for a fix and apply it as soon as it is available
Restrict administrative access to ESG appliances to trusted networks
Review appliance logs for unexpected authentication events or unknown commands
Confirm that no unauthorized accounts or processes exist on ESG appliances
Timeline
- Made public by SecurityWeek
- First seen by cve.now
Evidence 1
- PressSecurityWeek
“An authentication bypass and a command injection flaw can be chained for root access on Barracuda’s Email Security Gateway appliances.”
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about SZB-2765c964a0
Has Barracuda confirmed it?
SecurityWeek reports it. No statement from Barracuda has reached cve.now yet.Source: SecurityWeek
What should Barracuda users do?
Check Barracuda's security advisories for a fix and apply it as soon as it is available. Restrict administrative access to ESG appliances to trusted networks. Review appliance logs for unexpected authentication events or unknown commands. Confirm that no unauthorized accounts or processes exist on ESG appliances.