ZeroDay Findings
Sign inSign up

Findings

CVE-2023-2868

Barracuda Networks ESG Appliance Improper Input Validation Vulnerability

Published May 24, 2023 · updated Jun 16, 2026 · barracuda email security gateway 300 firmware

A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.

Timeline

Detection, updates, and resolution for this record.

  1. May 24, 2023 · Catalog

    Detected

    A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the

  2. May 26, 2023 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jun 16, 2023 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the

Required action

Apply updates per vendor instructions.

CISA due date Jun 16, 2023

Affected

  • cpe barracuda/email security gateway 300 firmwareversion unspecified
  • cpe barracuda/email security gateway 400 firmwareversion unspecified
  • cpe barracuda/email security gateway 600 firmwareversion unspecified
  • cpe barracuda/email security gateway 800 firmwareversion unspecified
  • cpe barracuda/email security gateway 900 firmwareversion unspecified
  • vendor Barracuda Networks Email Security Gateway (ESG) Applianceversion unspecified

Sources

  • CISA KEVCVE-2023-2868

    Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection.

    cisa.gov
  • CVE.orgCVE-2023-2868

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2023-2868

    30-day exploitation probability 87.7%

    first.org
  • Metasploit Modulesexploit_linux/smtp/barracuda_esg_tarfile_rce

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2023-2868

    A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives).

    nvd.nist.gov

References