{"id":"CVE-2025-34392","title":"Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application","summary":"Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application. This can lead to arbitrary file write an…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-36"],"vendor":"barracuda","product":"rmm","affected":["rmm < 2025.1.1"],"patched":["rmm 2025.1.1"],"published":"2025-12-10","updated":"2026-10-14","sourceUpdated":"2026-10-14T21:10:00.183","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-34392","references":[{"url":"https://download.mw-rmm.barracudamsp.com/PDF/2025.1.1/RN_BRMM_2025.1.1_EN.pdf","label":"disclosure@vulncheck.com"},{"url":"https://labs.watchtowr.com/soapwn-pwning-net-framework-applications-through-http-client-proxies-and-wsdl/","label":"disclosure@vulncheck.com"},{"url":"https://www.barracuda.com/products/msp/network-protection/rmm","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/barracuda-rmm-service-center-absolute-path-traversal-rce","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"epss":0.24721,"epssPercentile":0.9787,"ingestedAt":"2026-10-14T21:57:04.783Z","slug":"CVE-2025-34392","body":"## Overview\n\nBarracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application. This can lead to arbitrary file write and remote code execution via webshell upload.\n\n## Affected\n\n- `rmm < 2025.1.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `rmm 2025.1.1`","depth":"midnight","depthScore":59,"depthScoreParts":{"impact":53.9,"likelihood":4.9,"exploitation":0,"ransomware":0},"changes":[]}