Barracuda Networks Vulnerabilities and Affected Products
Vulnerabilities associated with Web Application Firewall.
Products
Clear product- RMM5 vulnerabilities
- barracuda_spam_firewall3 vulnerabilities
- Email Security Gateway (ESG) Appliance2 vulnerabilities
- Spam & Virus Firewall1 vulnerability
- SSL VPN1 vulnerability
- Web Application Firewall1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2010-20109HIGH | Barracuda Spam & Virus Firewall "locale" Path TraversalBarracuda products, confirmed in Spam & Virus Firewall, SSL VPN, and Web Application Firewall versions prior to October 2010, contain a path traversal vulnerability in the view_help.cgi endpoint. The locale parameter fails to properly sanitize user input, allowing attackers to inject traversal sequences and null-byte terminators to access arbitrary files on the underlying system. By exploiting this flaw, unauthenticated remote attackers can retrieve sensitive configuration files such as /mail/sn… CWE-22Aug 21, 2025 | CVSS8.7v4.0 | EPSS1.17% | PoCs2 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |