CVE-2025-34392
Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is lat…
Published Dec 10, 2025 · updated Oct 14, 2026 · barracuda rmm
Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application. This can lead to arbitrary file write and remote code execution via webshell upload.
Timeline
Detection, updates, and resolution for this record.
Dec 10, 2025 · NIST NVD
Detected
Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application. This can lead to arbitrary file write and remote code execution via webshell upload.
Oct 14, 2026 · NIST NVD
Updated
Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application. This can lead to arbitrary file write and remote code execution via webshell upload.
Affected
- cpe barracuda/rmmversion unspecified
Sources
- CVE.orgCVE-2025-34392
Official CVE identifier
cve.org - FIRST EPSSCVE-2025-34392
30-day exploitation probability 24.7%
first.org - NIST NVDCVE-2025-34392
Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application. This can lead to arbitrary file write and remote code execution via webshell upload
nvd.nist.gov