CVE-2025-34392
Barracuda RMM < 2025.1.1 Service Center Absolute Path Traversal RCE
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application. This can lead to arbitrary file write and remote code execution via webshell upload.
| CWE | CWE-36 |
| Vendor | barracuda networks |
| Product | rmm |
| Published | Dec 10, 2025 |
| Last Updated | Mar 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for barracuda networks rmm
Be the first to know when new unknown vulnerabilities affecting barracuda networks rmm are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Barracuda Networks / RMM
2025.1 < 2025.1.1
References
download.mw-rmm.barracudamsp.com: https://download.mw-rmm.barracudamsp.com/PDF/2025.1.1/RN_BRMM_2025.1.1_EN.pdf barracuda.com: https://www.barracuda.com/products/msp/network-protection/rmm vulncheck.com: https://www.vulncheck.com/advisories/barracuda-rmm-service-center-absolute-path-traversal-rce labs.watchtowr.com: https://labs.watchtowr.com/soapwn-pwning-net-framework-applications-through-http-client-proxies-and-wsdl/
Credits
Piotr Bazydlo of watchTowr