Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login

Researchers have discovered two vulnerabilities in Barracuda's Email Security Gateway that can be exploited together to gain root access without needing to log in. The flaws allow an attacker to run commands on the appliance with its highest level of access. One of the vulnerabilities is an authorization bypass issue. Barracuda has released patches to address the vulnerabilities, and a security firm has provided details on the attack chain. The authorization bypass vulnerability can be used by an unauthenticated attacker to restore a system. Patches for the issues were released by the company on Monday.