CVE-2025-34395: Barracuda RMM < 2025.1.1 Service Center .NET Remoting Path Traversal RCE

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-10 · updated 2026-10-14
Weakness: CWE-22

Description

Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, exposes a .NET Remoting service in which an unauthenticated attacker can invoke a method vulnerable to path traversal to read arbitrary files. This vulnerability can be escalated to remote code execution by retrieving the .NET machine keys.

Affected products

Barracuda Networks RMM: before 2025.1.1 — fixed in 2025.1.1

How to fix

Upgrade to a fixed version: Barracuda Networks RMM 2025.1.1. Check the vendor advisory for mitigations.

References

https://download.mw-rmm.barracudamsp.com/PDF/2025.1.1/RN_BRMM_2025.1.1_EN.pdf
https://www.barracuda.com/products/msp/network-protection/rmm
https://www.vulncheck.com/advisories/barracuda-rmm-service-center-net-remoting-path-traversal-rce

Get alerted when CVE-2025-34395 or the next vulnerability affects your stack