Barracuda RMM < 2025.1.1 Service Center .NET Remoting Path Traversal RCE

Advisories

severity: high
date: December 10, 2025
Affecting: RMM < 2025.1.1
CVE: CVE-2025-34395
CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSS: 8.7
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References: Barracuda RMM Vendor Advisory
Barracuda RMM Product Webpage
Credit: Piotr Bazydlo of watchTowr
Description: Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, exposes a .NET Remoting service in which an unauthenticated attacker can invoke a method vulnerable to path traversal to read arbitrary files. This vulnerability can be escalated to remote code execution by retrieving the .NET machine keys.