Read the docs
TI-2023-06497 Aliases CVE-2023-7102GHSA-ccqc-vx6w-76x6

Remote code execution (RCE) in Barracuda ESG Appliance

Priority HIGH 71CWE-1104Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic.

Why it matters now

EPSS 0.44575 98th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Barracuda NetworksBarracuda ESG Appliance5.1.3.001 – 9.2.1.001—No fix listedCNA
  • Barracuda ESG Appliance VendorBarracuda Networks Affected 5.1.3.001 – 9.2.1.001 Fixed in — No fix listed CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:o:barracuda:email_security_gateway_300_firmware:*:*:*:*:*:*:*:*5.1.3.001 – 9.2.1.001VulnerableBarracuda
cpe:2.3:h:barracuda:email_security_gateway_300:-:*:*:*:*:*:*:*not specified by NVDRunning onBarracuda
cpe:2.3:o:barracuda:email_security_gateway_400_firmware:*:*:*:*:*:*:*:*5.1.3.001 – 9.2.1.001VulnerableBarracuda
cpe:2.3:h:barracuda:email_security_gateway_400:-:*:*:*:*:*:*:*not specified by NVDRunning onBarracuda
cpe:2.3:o:barracuda:email_security_gateway_600_firmware:*:*:*:*:*:*:*:*5.1.3.001 – 9.2.1.001VulnerableBarracuda
cpe:2.3:h:barracuda:email_security_gateway_600:-:*:*:*:*:*:*:*not specified by NVDRunning onBarracuda
cpe:2.3:o:barracuda:email_security_gateway_800_firmware:*:*:*:*:*:*:*:*5.1.3.001 – 9.2.1.001VulnerableBarracuda
cpe:2.3:h:barracuda:email_security_gateway_800:-:*:*:*:*:*:*:*not specified by NVDRunning onBarracuda
cpe:2.3:o:barracuda:email_security_gateway_900_firmware:*:*:*:*:*:*:*:*5.1.3.001 – 9.2.1.001VulnerableBarracuda
cpe:2.3:h:barracuda:email_security_gateway_900:-:*:*:*:*:*:*:*not specified by NVDRunning onBarracuda
  • cpe:2.3:o:barracuda:email_security_gateway_300_firmware:*:*:*:*:*:*:*:* Versions 5.1.3.001 – 9.2.1.001 Vulnerable ·Barracuda
  • cpe:2.3:h:barracuda:email_security_gateway_300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Barracuda
  • cpe:2.3:o:barracuda:email_security_gateway_400_firmware:*:*:*:*:*:*:*:* Versions 5.1.3.001 – 9.2.1.001 Vulnerable ·Barracuda
  • cpe:2.3:h:barracuda:email_security_gateway_400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Barracuda
  • cpe:2.3:o:barracuda:email_security_gateway_600_firmware:*:*:*:*:*:*:*:* Versions 5.1.3.001 – 9.2.1.001 Vulnerable ·Barracuda
  • cpe:2.3:h:barracuda:email_security_gateway_600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Barracuda
  • cpe:2.3:o:barracuda:email_security_gateway_800_firmware:*:*:*:*:*:*:*:* Versions 5.1.3.001 – 9.2.1.001 Vulnerable ·Barracuda
  • cpe:2.3:h:barracuda:email_security_gateway_800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Barracuda
  • cpe:2.3:o:barracuda:email_security_gateway_900_firmware:*:*:*:*:*:*:*:* Versions 5.1.3.001 – 9.2.1.001 Vulnerable ·Barracuda
  • cpe:2.3:h:barracuda:email_security_gateway_900:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Barracuda

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-7102
  2. 2026-10-03 Alias added: GHSA-ccqc-vx6w-76x6

References

Advisory 4

Other 2

  • TI-2023-02687 Remote Code injection in Barracuda Email Security Gateway KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-24469 Barracuda RMM < 2025.1.1 Service Center Absolute Path Traversal RCE CVSS 4.0CRITICAL 10.0
  • TI-2010-05064 Barracuda Spam & Virus Firewall "locale" Path Traversal CVSS 4.0HIGH 8.7
  • TI-2005-02695 img.pl in Barracuda Spam Firewall running firmware 3.1.16 and 3.1.17 allows remote… CVSS 2.0HIGH 7.5
  • TI-2025-24471 Barracuda RMM < 2025.1.1 Service Center .NET Remoting Deserialization RCE CVSS 4.0CRITICAL 10.0
  • TI-2025-24470 Barracuda RMM < 2025.1.1 Service Center Insecure Reflection RCE CVSS 4.0CRITICAL 10.0
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences