CVE-2025-34392

published 2025-12-10

CVE-2025-34392: Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL…

Priority P2 76 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application. This can lead to arbitrary file write and remote code execution via webshell upload.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
barracuda	rmm	< 2025.1.1	2025.1.1
barracuda_networks	rmm	>= 2025.1 < 2025.1.1	2025.1.1

Detection & IOCs extracted from sources · hover to see the quote

path /SCMessaging/scnoc.asmx

other SOAPAction HTTP header present in POST to /SCMessaging/scnoc.asmx

other <urlwsdl> element containing http:// or file:// scheme in SOAP request body

other <wsmethod> element in SOAP request body

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Barracuda RMM Service Center Absolute Path Traversal RCE (CVE-2025-34392)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:23; content:"|2f|SCMessaging|2f|scnoc|2e|asmx"; fast_pattern; http.header_names; to_lowercase; content:"|0d 0a|soapaction|0d 0a|"; http.request_body; content:"|3c|urlwsdl|3e 3c|"; pcre:"/^(?:http|file)\x3a\x2f\x2f/R"; content:"|2e|wsdl|3e 3c 2f|urlwsdl|3e|"; distance:0; content:"|3c|wsmethod|3e|"; content:"|3c 2f|wsmethod|3e|"; reference:url,labs.watchtowr.com/soapwn-pwning-net-framework-applications-through-http-client-proxies-and-wsdl/; reference:cve,2025-34392; classtype:attempted-admin; sid:2066258; rev:1; metadata:affected_product Barracuda_RMM, attack_target Server, tls_state TLSDecrypt, created_at 2025_12_10, cve CVE_2025_34392, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, updated_at 2025_12_10, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

• → Detect HTTP POST requests to the exact URI /SCMessaging/scnoc.asmx (length 23 bytes) with a SOAPAction header and a body containing attacker-controlled <urlwsdl> pointing to an http:// or file:// URL ending in .wsdl — this is the exploitation path for the unvalidated WSDL fetch.
• → The exploit leads to arbitrary file write and webshell upload (remote code execution); monitor the Barracuda RMM web root for newly created .aspx/.asmx files following suspicious SOAP requests to /SCMessaging/scnoc.asmx. ↗
• → The Snort/Suricata rule (ET sid:2066258) requires TLS decryption (tls_state TLSDecrypt) for effective detection in encrypted traffic environments.
• → The vulnerability is rooted in .NET Framework HTTP client proxy / WSDL handling; refer to the watchTowr research for deeper exploitation mechanics.

• · The Snort/Suricata rule requires TLS inspection to be effective against HTTPS traffic; without TLS decryption the rule will not fire on encrypted sessions.
• · Affected versions are Barracuda RMM Service Center prior to 2025.1.1; ensure the version check is part of any asset-scoping exercise before deploying detections. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v4.0 10.0 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-36