CVE-2025-34392 is a critical flaw (CVSS 9.8 in the record) in Barracuda Service Center, part of the Barracuda RMM product. It does not verify a URL taken from an attacker controlled WSDL, allowing arbitrary file write and code execution through a web shell. Versions before 2025.1.1 are affected. Upgrade to 2025.1.1 or later.
What's affected
The record says Barracuda Service Center, as implemented in the RMM solution, is affected in versions prior to 2025.1.1. The vendor release notes for 2025.1.1 are linked from the record, and the VulnCheck advisory lists RMM below 2025.1.1 as affected. The advisory credits Piotr Bazydlo of watchTowr.
Two more CVEs came out of the same research and carry the same fix floor: CVE-2025-34393 and CVE-2025-34394. Updating to 2025.1.1 or later is the answer for all three according to their advisories.
VulnCheck scores this one 10 on its scale, and the score in the record is 9.8. Either way it sits at the top of the range.
How to check if you're exposed
Find your RMM server and check the version in the product console or the installed programs list. If it shows anything older than 2025.1.1, it is in range.
Check how Service Center is exposed. RMM platforms are managed by service providers and often published to the internet so that agents and staff can connect. Ask which ports and paths are reachable from outside, and whether the Service Center web service is among them.
If the server has been exposed on an old version, hunt for new files in the web directories that you did not deploy, especially script or page files. Review the server for unexpected child processes spawned by the web service. The advisory describes web shell upload as the outcome, so unfamiliar files are the clue to look for. Involve your incident response process if anything looks wrong.
What to do now
- Upgrade Barracuda RMM to 2025.1.1 or later, following the vendor release notes.
- If you cannot upgrade today, restrict access to Service Center to known addresses or a VPN.
- Search web directories for unexpected files and review recent process activity on the server.
- Rotate credentials and secrets held by the RMM platform if you suspect compromise, and consider the credentials of managed endpoints, because an RMM tool can act on all of them.
- Apply the same upgrade for CVE-2025-34393 and CVE-2025-34394, which share the fix.
Why it matters
The class is CWE-36 (Absolute Path Traversal). The application loads a WSDL, which is a description of a web service, and then acts on a URL inside it without checking where that URL leads. Because the attacker controls the WSDL, they influence where files go. The result in the advisory is arbitrary file write, and writing into a web served folder means code execution.
The research behind this CVE looks at .NET applications that use HTTP client proxies generated from WSDL descriptions. The takeaway for builders is to treat a service description supplied from outside as untrusted input and pin it to known locations. For defenders, the takeaway is that management platforms such as RMM tools deserve the fastest patching, since one compromise reaches many machines. The record does not flag the CVE as listed in CISA KEV.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes it?
Barracuda RMM 2025.1.1 per the CVE record and the advisory. Use the vendor release notes for the exact upgrade steps.
Do the sibling CVEs need a separate patch?
No. CVE-2025-34393 and CVE-2025-34394 list the same fixed floor, 2025.1.1.
Sources
Last reviewed: 18 October 2026.
