TI-2006-03956 Aliases CVE-2006-4081 GHSA-c7vp-rjm4-r724

preview_email.cgi in Barracuda Spam Firewall (BSF) 3.3.01.001 through 3.3.03.053 allows…

MEDIUM 40Published 2006-08-11 · Updated 2024-08-07

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Partial · Partial · Partial
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

preview_email.cgi in Barracuda Spam Firewall (BSF) 3.3.01.001 through 3.3.03.053 allows remote attackers to execute commands via shell metacharacters ("|" pipe symbol) in the file parameter. NOTE: the attack can be extended to arbitrary commands by the presence of CVE-2006-4000.

Why it matters now

EPSS 0.04293 91st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:h:barracuda_networks:barracuda_spam_firewall:3.3.01.001:::::::*	3.3.01.001	Vulnerable	Barracuda Networks
cpe:2.3:h:barracuda_networks:barracuda_spam_firewall:3.3.03.053:::::::*	3.3.03.053	Vulnerable	Barracuda Networks

cpe:2.3:h:barracuda_networks:barracuda_spam_firewall:3.3.01.001:*:*:*:*:*:*:* Versions 3.3.01.001 Vulnerable ·Barracuda Networks
cpe:2.3:h:barracuda_networks:barracuda_spam_firewall:3.3.03.053:*:*:*:*:*:*:* Versions 3.3.03.053 Vulnerable ·Barracuda Networks

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2006-4081
2026-10-03 Alias added: GHSA-c7vp-rjm4-r724

References

Advisory 1

1363

Other 1

20060804 Barracuda Spam Firewall: Administrator Level Remote Command Execution [ID-20060804-01]

TI-2005-02695 img.pl in Barracuda Spam Firewall running firmware 3.1.16 and 3.1.17 allows remote… CVSS 2.0HIGH 7.5
TI-2007-01612 unzoo.c, as used in multiple products including AMaViS 2.4.1 and earlier, allows remote… CVSS 2.0HIGH 7.8
TI-2006-03877 Login.pm in Barracuda Spam Firewall (BSF) 3.3.01.001 through 3.3.03.053 contains a… CVSS 2.0HIGH 7.5
TI-2005-00389 Barracuda Spam Firewall 3.1.10 and earlier does not restrict the domains that… CVSS 2.0HIGH 7.5
TI-2005-02696 Directory traversal vulnerability in img.pl in Barracuda Spam Firewall running firmware… CVSS 2.0MEDIUM 5.0
TI-2008-01048 SQL injection vulnerability in index.cgi in the Account View page in Barracuda Spam… CVSS 2.0MEDIUM 6.5

See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences