https://pwn.watch/t/email-security Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 15 Jun 2023 00:00:00 GMT https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868 https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868 Thu, 15 Jun 2023 00:00:00 GMT critical <p>A command injection in how Barracuda ESG appliances scan .tar attachments was exploited since October 2022 by China-nexus UNC4841 to backdoor appliances. Barracuda later told customers to replace compromised appliances outright, even after patching.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory (patch pushed to all appliances May 20–21, 2023; compromised appliances must be replaced)</p> <p><strong>Latest updates:</strong></p><ul><li>2023-06-15: Mandiant attributes the campaign to China-nexus UNC4841 (<a href="https://cloud.google.com/blog/topics/threat-intelligence/barracuda-esg-exploited-globally">source</a>)</li><li>2023-06-06: Barracuda tells customers to replace compromised appliances immediately, regardless of patch level (<a href="https://www.barracuda.com/company/legal/esg-vulnerability">source</a>)</li><li>2023-05-30: Barracuda: exploitation dates back to October 2022, with SALTWATER, SEASPY and SEASIDE malware (<a href="https://www.barracuda.com/company/legal/esg-vulnerability">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2023-2868</p>