Read the docs
TI-2019-04010 Aliases CVE-2019-5648GHSA-5ghg-57ch-849f

LDAP Credential Exposure in Barracuda Load Balancer ADC

Priority LOW 31CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-522.

Summary

Authenticated, administrative access to a Barracuda Load Balancer ADC running unpatched firmware <= v6.4 allows one to edit the LDAP service configuration of the balancer and change the LDAP server to an attacker-controlled system, without having to re-enter LDAP credentials. These steps can be used by any authenticated administrative user to expose the LDAP credentials configured in the LDAP connector over the network.

Why it matters now

EPSS 0.01125 66th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Load Balancer ADC (Barracuda): 6.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
BarracudaLoad Balancer ADCbefore 6.56.5Patch availableCNA
  • Load Balancer ADC VendorBarracuda Affected before 6.5 Fixed in 6.5 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:barracuda:load_balancer_adc_firmware:*:*:*:*:*:*:*:*up to 6.4VulnerableBarracuda
cpe:2.3:h:barracuda:load_balancer_adc:-:*:*:*:*:*:*:*not specified by NVDRunning onBarracuda
  • cpe:2.3:o:barracuda:load_balancer_adc_firmware:*:*:*:*:*:*:*:* Versions up to 6.4 Vulnerable ·Barracuda
  • cpe:2.3:h:barracuda:load_balancer_adc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Barracuda

Remediation

  • Fix · CNA Load Balancer ADC (Barracuda) Fixed in 6.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-5648
  2. 2026-10-03 Alias added: GHSA-5ghg-57ch-849f

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences