Barracuda Networks, whose email and network security devices are widely used by small and mid-sized businesses, is warning customers to install patches for two vulnerabilities. Used together, they could let an attacker get around the device's login checks and gain "root" access, the highest level of control over the device.
The first is a critical weakness in how the Email Security Gateway checks who is allowed in, which could let an attacker change the device's overall settings. The second lets someone who already has admin access run their own commands on the device.
There is one important limit: an attacker needs to reach the device's administrative interface to use these flaws. Barracuda recommends keeping that interface locked down so only trusted internal networks can reach it, and making sure devices run the latest firmware with all security patches.
This deserves prompt attention because security devices sit at the front door of a business network and handle its email. Barracuda email gateways have been targeted before: in 2023, attackers exploited a different flaw for months to install malware and steal data.
What you should do
- Find out whether your business uses any Barracuda products, such as an email gateway or firewall. Your IT provider will know.
- Confirm each device is on the latest firmware and has the new security patches applied.
- Make sure the admin page of each device can only be reached from your internal network, not from the internet.
- Use strong, unique admin passwords on security devices and limit who has admin access.
Computech prepares these summaries with AI assistance, based on public news reports. See the original report for full details.
