CVE-2023-2868

Barracuda Networks ESG Appliance Improper Input Validation

9.4 CRITICALActively exploited (CISA KEV)EPSS 87.7%

Published24 May 2023
Added to CISA KEV26 May 2023
Remediation due16 Jun 2023

Description

A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityLow

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Affected products

Barracuda Email Security Gateway 300 Firmware≥ 5.1.3.001 ≤ 9.2.0.006

Barracuda Email Security Gateway 400 Firmware≥ 5.1.3.001 ≤ 9.2.0.006

Barracuda Email Security Gateway 600 Firmware≥ 5.1.3.001 ≤ 9.2.0.006

Barracuda Email Security Gateway 800 Firmware≥ 5.1.3.001 ≤ 9.2.0.006

Barracuda Email Security Gateway 900 Firmware≥ 5.1.3.001 ≤ 9.2.0.006

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Patch & vendor advisories

References

https://status.barracuda.com/incidents/34kx82j5n4q9Vendor Advisory
https://www.barracuda.com/company/legal/esg-vulnerabilityMitigationVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2868US Government Resource

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2023-2868 being actively exploited?

Yes. CVE-2023-2868 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 26 May 2023.

How severe is CVE-2023-2868?

CVE-2023-2868 has a CVSS 3.1 base score of 9.4, rated critical. EPSS estimates a 87.7% probability of exploitation.

Which products are affected by CVE-2023-2868?

Affected products include Barracuda Email Security Gateway 300 Firmware, Barracuda Email Security Gateway 400 Firmware, Barracuda Email Security Gateway 600 Firmware, Barracuda Email Security Gateway 800 Firmware, Barracuda Email Security Gateway 900 Firmware.

How do I fix CVE-2023-2868?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2023-2868 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.