CVE-2025-34395
📋 TL;DR
This vulnerability in Barracuda Service Center allows unauthenticated attackers to read arbitrary files via path traversal in a .NET Remoting service. By retrieving .NET machine keys, attackers can escalate this to remote code execution. Organizations using Barracuda RMM solutions with Service Center versions before 2025.1.1 are affected.
💻 Affected Systems
- Barracuda Service Center (part of Barracuda RMM solution)
📦 What is this software?
Rmm by Barracuda
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with remote code execution leading to data theft, ransomware deployment, or complete network takeover.
Likely Case
Unauthorized file access leading to credential harvesting, configuration theft, and potential lateral movement within the network.
If Mitigated
Limited impact with only file enumeration possible if network segmentation and access controls prevent exploitation.
🎯 Exploit Status
The vulnerability requires no authentication and has clear path to RCE via machine key extraction, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2025.1.1
Vendor Advisory: https://download.mw-rmm.barracudamsp.com/PDF/2025.1.1/RN_BRMM_2025.1.1_EN.pdf
Restart Required: Yes
Instructions:
1. Download Barracuda RMM version 2025.1.1 from official sources. 2. Backup current configuration. 3. Install the update following vendor documentation. 4. Restart affected services/systems.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to Barracuda Service Center to only trusted management networks
Firewall Rules
windowsBlock external access to the .NET Remoting service port (default is often 9000-9001)
netsh advfirewall firewall add rule name="Block Barracuda Remoting" dir=in action=block protocol=TCP localport=9000,9001
🧯 If You Can't Patch
- Isolate affected systems from internet and untrusted networks
- Implement strict network segmentation and monitor for suspicious file access patterns
🔍 How to Verify
Check if Vulnerable:
Check Barracuda Service Center version in administration interface or via installed programs listCheck Version:
Check Control Panel > Programs and Features for Barracuda RMM version or consult service logsVerify Fix Applied:
Confirm version is 2025.1.1 or later in administration interface📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in Service Center logs
- Failed authentication attempts to .NET Remoting service
- Unexpected process execution
Network Indicators:
- Unusual traffic to .NET Remoting ports (9000-9001)
- External connections to Service Center from untrusted sources
SIEM Query:
source="Barracuda Service Center" AND (event_type="file_access" OR event_type="remoting_call") AND (file_path CONTAINS ".." OR user="anonymous")