Unrated severityNVD Advisory· Published Mar 3, 2023· Updated Mar 7, 2025

CVE-2023-26213

Description

On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injection vulnerability exists in /ajax/update_certificate - a crafted HTTP request allows an authenticated attacker to execute arbitrary commands. For example, a name field can contain :password and a password field can contain shell metacharacters.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Barracuda/CloudGen WAN Private Edge Gatewaydescription
Barracudadrive/Barracudadrivellm-fuzzy
Range: <8 webui-sdwan-1089-8.3.1-174141891

Patches

Vulnerability mechanics

References

seclists.org/fulldisclosure/2023/Mar/2mitremailing-list
campus.barracuda.com/product/cloudgenwan/doc/96024723/release-notes-8-3-1/mitre
sec-consult.com/vulnerability-lab/advisory/os-command-injection-in-barracuda-cloudgen-wan/mitre
www.barracuda.com/products/network-security/cloudgen-wanmitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.006
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000