Unrated severityNVD Advisory· Published Dec 10, 2025· Updated Mar 5, 2026
Barracuda RMM < 2025.1.1 Service Center Absolute Path Traversal RCE
CVE-2025-34392
Description
Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application. This can lead to arbitrary file write and remote code execution via webshell upload.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <2025.1.1
- Barracuda Networks/RMMv5Range: 2025.1
Patches
Vulnerability mechanics
References
4- labs.watchtowr.com/soapwn-pwning-net-framework-applications-through-http-client-proxies-and-wsdl/mitreexploit
- download.mw-rmm.barracudamsp.com/PDF/2025.1.1/RN_BRMM_2025.1.1_EN.pdfmitrevendor-advisorypatch
- www.vulncheck.com/advisories/barracuda-rmm-service-center-absolute-path-traversal-rcemitrethird-party-advisory
- www.barracuda.com/products/msp/network-protection/rmmmitreproduct
News mentions
1- SOAPwn: Pwning .NET Framework Applications Through HTTP Client Proxies And WSDLwatchTowr Labs · Dec 10, 2025