Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-34392 is a critical-severity Absolute Path Traversal (CWE-36) vulnerability in Barracuda Rmm. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-34392 is a critical vulnerability in Barracuda Service Center, a component of the Barracuda RMM solution, affecting versions prior to 2025.1.1. The issue arises because the application fails to verify the URL specified in an attacker-controlled Web Services Description Language (WSDL) file that it later loads. Classified under CWE-36 (Absolute Path Traversal), this flaw allows arbitrary file writes and remote code execution (RCE) via webshell upload. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), highlighting its severity.
Remote attackers can exploit CVE-2025-34392 over the network without authentication, privileges, or user interaction, requiring only low attack complexity. By supplying a malicious WSDL with a controlled URL, an attacker can trick the application into writing files to arbitrary locations, enabling webshell deployment and subsequent RCE on the targeted Barracuda Service Center instance.
Advisories recommend upgrading to Barracuda RMM version 2025.1.1 or later, as outlined in the official release notes. Watchtower Labs provides technical details on the underlying SOAP/WSDL proxy exploitation technique in .NET Framework applications, while Vulncheck's advisory elaborates on the absolute path traversal mechanism leading to RCE in Barracuda Service Center.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-202447
Vulnerability Data
Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application. This can lead to arbitrary file write and remote…
more
code execution via webshell upload.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly stops construction of absolute paths from untrusted data before they reach file operations.
Enforced access authorizations can limit which resources are reachable even if a traversal succeeds.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and path sanitization that prevent absolute path traversal.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect absolute path traversal via static analysis and fuzzing.
Secure development lifecycle includes input validation and path-handling requirements that reduce absolute path traversal risk.
Application security requirements typically mandate controls against path traversal in file-access functions.
Secure architecture principles call for canonicalization and sandboxing that limit absolute path traversal.
Secure coding standards directly require neutralization of absolute path sequences in pathname construction.
Information access restriction limits which files can be reached but does not address the path-construction flaw itself.