Barracuda Email Security Gateway zero-day (CVE-2023-2868)
Barracuda Email Security Gateway (appliance)
A command injection in how Barracuda ESG appliances scan .tar attachments was exploited since October 2022 by China-nexus UNC4841 to backdoor appliances. Barracuda later told customers to replace compromised appliances outright, even after patching.
Why this severity: CVSS 9.8 (NVD), zero-day, actively exploited (CISA KEV)
- Started
- May 18, 2023
- Closed
- Jun 15, 2023
Affected
- 5.1.3.001 to 9.2.0.006 (appliance form factor only) (NVD)
Fixed in
- See vendor advisory (patch pushed to all appliances May 20–21, 2023; compromised appliances must be replaced)
Updates by day6
▸Jun 15, 2023
Link #Mandiant attributes the campaign to China-nexus UNC4841
Source
▸Jun 6, 2023
Link #Barracuda tells customers to replace compromised appliances immediately, regardless of patch level
Source
▸May 30, 2023
Link #Barracuda: exploitation dates back to October 2022, with SALTWATER, SEASPY and SEASIDE malware
Source
▸May 26, 2023
Link #CISA adds CVE-2023-2868 to the KEV catalog
▸May 20, 2023
Link #Security patch pushed to all ESG appliances worldwide
Source
▸May 18, 2023
Link #Barracuda notices anomalous traffic from ESG appliances
Source
Advisories3
Notes & caveats
startedAt is detection; exploitation began in October 2022 per Barracuda.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
