Barracuda qurilmalarga root kirish imkonini beruvchi jiddiy zaifliklar haqida ogohlantirdi

Kiberxavfsizlik kompaniyasi Barracuda Networks mijozlarga hujumchilarga root huquqlari bilan buyruqlarni bajarish imkonini beradigan ikkita zaiflikni tuzatishni ogohlantirdi.

Birinchisi — Email Security Gateway (ESG) autentifikatsiya zaifligidan kelib chiqqan jiddiy zaiflik (CVE-2026-116606), bu hujumchilarga qurilmaning global konfiguratsiyasini o'zgartirish imkonini beradi, ikkinchisi (CVE-2026-111560) esa admin huquqlariga ega tahdid ishtirokchilariga root sifatida ishlaydigan OS buyruqlarini kiritish imkonini beradi.

Biroq, Barracuda muvaffaqiyatli ekspluatatsiya maqsadli qurilmalarning ma'muriy interfeyslariga kirishni ham talab qilishini aytdi va mijozlarga tegishli tarmoq kirish nazoratlarini qo'llash va ta'sirni cheklash uchun ishonchli ichki tarmoqlarga kirishni cheklashni maslahat berdi.

"Muvaffaqiyatli ekspluatatsiya hujumchidan ta'sirlangan mahsulotning ma'muriy interfeysiga kirishni talab qiladi. Agar birgalikda ekspluatatsiya qilinsa, bu zaifliklar hujumchiga avtorizatsiya nazoratlarini chetlab o'tish va qurilmaga root kirish huquqini olish imkonini berishi mumkin," deb tushuntirdi kompaniya.

"Barracuda darhol keng qamrovli tuzatish jarayonini boshladi va ta'sirlangan mahsulotlar uchun xavfsizlik yamoqlarini chiqardi. Mijozlar ta'sirlangan mahsulotlar va tuzatish yo'riqnomalarini ko'rib chiqishlari, tizimlari eng so'nggi proshivka versiyasida ishlayotganiga ishonch hosil qilishlari va barcha xavfsizlik yamoqlari qo'llanilganligiga ishonch hosil qilishlari kerak."

Barcha ta'sirlangan qurilmalar va mavjud xavfsizlik yamoqlarining to'liq ro'yxati quyidagi jadvalda keltirilgan.

Cybersecurity company Barracuda Networks warned customers to patch two vulnerabilities that can let attackers run commands with root privileges.

The first is a critical flaw (CVE-2026-116606) stemming from an Email Security Gateway (ESG) authentication weakness that attackers can exploit to modify an appliance's global configuration, while the second (CVE-2026-111560) lets threat actors with admin permissions inject OS commands that run as root.

However, Barracuda said successful exploitation also requires access to the administrative interfaces of targeted devices and advised customers to use appropriate network access controls and restrict access to trusted internal networks to limit exposure.

"Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device," the company explained.

"Barracuda immediately initiated a comprehensive remediation process and released security patches for affected products. Customers should review the affected products and remediation guidance [..], ensure their systems are running the latest firmware version, and have all security patches applied."

A complete list of all affected devices and available security patches is available in the table below.