Description
Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not correctly verify the name of an attacker-controlled WSDL service, leading to insecure reflection. This can result in remote code execution through either invocation of arbitrary methods or deserialization of untrusted types.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Barracuda Networks | RMM | 2025.1 – < 2025.1.1 | 2025.1.1 |