Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login
AI summary
Two flaws in Barracuda's Email Security Gateway can be chained to execute commands as root, the appliance's highest privilege level, without requiring a login. Barracuda released patches on Monday, and the security firm watchTowr detailed the attack chain. The unauthenticated root-level exposure makes timely patching important for organizations running this email-filtering appliance.
Headline and excerpt are shown for attribution. Full text remains with the publisher.
Request a consultation
Talk to a vetted security partner
News, not security advice. Patch and confirm with your own team.
Ask one question
Ask a specialist one question
No call, no form interview. Send the question you would ask a colleague, and a vetted specialist in this field answers in writing.
Reference document
Known-exploited vulnerabilities, weekly
A weekly list of the vulnerabilities attackers are already exploiting, limited to the vendors you run, with the one action to take. Free.
Related coverage
CTM360 Exposes Fake Gift Card Scams Exploiting Trusted Brands
CTM360 has documented a wave of fake gift card giveaways in which scammers impersonate well-known brands and celebrities to draw in consumers. The campaigns use bogus verification steps to harvest personal information and enroll victims in unwanted subscriptions, then monetize the resulting traffic through affiliate networks. For security and brand teams, the findings show how trusted names can be exploited at low cost to fuel fraud, and how affiliate-style revenue models keep such schemes profitable and persistent.
SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
SonicWall has released security updates fixing seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass that has already been exploited in attacks. The flaw can let attackers circumvent MFA on SSL-VPN access, weakening a key remote-access control. Organizations running affected SonicWall firewalls should treat the issue as urgent and apply the vendor’s fixes promptly.
QNAP says hackers breaching NAS devices in Plex2Shell attacks
QNAP is warning customers that attackers are exploiting a vulnerability chain dubbed Plex2Shell to breach its network-attached storage devices. Users are being urged to install the newest version of Plex Media Server from the QNAP App Center. The warning matters for anyone running Plex on QNAP hardware, since unpatched devices may be exposed to active attacks.
The process
How this works
- 1
Send the form
Name, email, and what you need. One request, one channel.
- 2
We route it
A vetted independent partner for this channel receives it. No one else does.
- 3
You get a reply
Within one business day, at no cost and with no obligation.
One partner per channel. Your details are never sold, and no partner sees another partner's requests.