Read the docs
TI-2023-02687 Aliases CVE-2023-2868GHSA-898g-hmh5-hrcr

Remote Code injection in Barracuda Email Security Gateway

Priority CRITICAL 100Exploited in the wildCWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-77.

Summary

A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.

Why it matters now

Exploitation Active In CISA KEV since 2023-05-26CISA due date 2023-06-16
EPSS 0.86841 99th percentileScored 2026-11-07
Fix Fixed Barracuda Email Security Gateway (Barracuda): 9.2.0.006

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BarracudaBarracuda Email Security Gateway5.1.3.001 to before 9.2.0.0069.2.0.006Patch availableCNA
  • Barracuda Email Security Gateway VendorBarracuda Affected 5.1.3.001 to before 9.2.0.006 Fixed in 9.2.0.006 Patch available CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:o:barracuda:email_security_gateway_300_firmware:*:*:*:*:*:*:*:*5.1.3.001 – 9.2.0.006VulnerableBarracuda
cpe:2.3:h:barracuda:email_security_gateway_300:-:*:*:*:*:*:*:*not specified by NVDRunning onBarracuda
cpe:2.3:o:barracuda:email_security_gateway_400_firmware:*:*:*:*:*:*:*:*5.1.3.001 – 9.2.0.006VulnerableBarracuda
cpe:2.3:h:barracuda:email_security_gateway_400:-:*:*:*:*:*:*:*not specified by NVDRunning onBarracuda
cpe:2.3:o:barracuda:email_security_gateway_600_firmware:*:*:*:*:*:*:*:*5.1.3.001 – 9.2.0.006VulnerableBarracuda
cpe:2.3:h:barracuda:email_security_gateway_600:-:*:*:*:*:*:*:*not specified by NVDRunning onBarracuda
cpe:2.3:o:barracuda:email_security_gateway_800_firmware:*:*:*:*:*:*:*:*5.1.3.001 – 9.2.0.006VulnerableBarracuda
cpe:2.3:h:barracuda:email_security_gateway_800:-:*:*:*:*:*:*:*not specified by NVDRunning onBarracuda
cpe:2.3:o:barracuda:email_security_gateway_900_firmware:*:*:*:*:*:*:*:*5.1.3.001 – 9.2.0.006VulnerableBarracuda
cpe:2.3:h:barracuda:email_security_gateway_900:-:*:*:*:*:*:*:*not specified by NVDRunning onBarracuda
  • cpe:2.3:o:barracuda:email_security_gateway_300_firmware:*:*:*:*:*:*:*:* Versions 5.1.3.001 – 9.2.0.006 Vulnerable ·Barracuda
  • cpe:2.3:h:barracuda:email_security_gateway_300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Barracuda
  • cpe:2.3:o:barracuda:email_security_gateway_400_firmware:*:*:*:*:*:*:*:* Versions 5.1.3.001 – 9.2.0.006 Vulnerable ·Barracuda
  • cpe:2.3:h:barracuda:email_security_gateway_400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Barracuda
  • cpe:2.3:o:barracuda:email_security_gateway_600_firmware:*:*:*:*:*:*:*:* Versions 5.1.3.001 – 9.2.0.006 Vulnerable ·Barracuda
  • cpe:2.3:h:barracuda:email_security_gateway_600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Barracuda
  • cpe:2.3:o:barracuda:email_security_gateway_800_firmware:*:*:*:*:*:*:*:* Versions 5.1.3.001 – 9.2.0.006 Vulnerable ·Barracuda
  • cpe:2.3:h:barracuda:email_security_gateway_800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Barracuda
  • cpe:2.3:o:barracuda:email_security_gateway_900_firmware:*:*:*:*:*:*:*:* Versions 5.1.3.001 – 9.2.0.006 Vulnerable ·Barracuda
  • cpe:2.3:h:barracuda:email_security_gateway_900:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Barracuda

Remediation

  • Fix · CNA Barracuda Email Security Gateway (Barracuda) Fixed in 9.2.0.006

Timeline

  1. 2023-05-26 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2023-2868
  3. 2026-10-03 Alias added: GHSA-898g-hmh5-hrcr

References

Advisory 2

  • TI-2023-06497 Remote code execution (RCE) in Barracuda ESG Appliance CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences