Search/CVE-2023-7102
● CVE — Critical

CVE-2023-7102

VendorbarracudaProductemail security gateway 300 firmware, email security gateway 400 firmware, email security gateway 600 firmware, email security gateway 800 firmware, email security gateway 900 firmwareDiscoveredDec 24, 2023UpdatedNov 21, 2024

Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic.

View graph Watch Export
CVSS v3.1
9.8 CRITICAL
EPSS
44.6%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
2
sources referencing this CVE
Related IOCs
1
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Sep 2, 2026
▲ 0.98pp
43.6% → 44.6% over 2 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Connections
9 relationships
Timeline
disclosure → media coverage
Dec 24, 2023
Disclosure — published as a CVE record. · last revised by NVD Nov 21, 2024
Oct 6, 2026
thehackernews.com reports: Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan
Nov 3, 2026
bleepingcomputer.com reports: Barracuda warns of critical flaws allowing root access to devices