Barracuda ESG authentication bypass can combine with a root command-injection flaw

Barracuda says the two flaws can be combined to obtain root access when an attacker can reach the administrative interface. Only ESG is listed as affected by the authentication bypass. Do not extend that unauthenticated chain to every other product.

Mandiant identifies the command-injection exposure as ESG through 9.4.0.27, ADC through 6.4.0, WAF through 11.0.1, WSG through 16.1.100.100, BMA through 5.5.4.0 and WCC through 2.2.1. The timezone flaw by itself requires administrator authentication. The ESG import bypass has a separate affected range: before 9.4.0.030.

The vendor page labels both vulnerabilities “Authentication Required: Yes, administrative access,” despite calling the first pre-authentication and describing a combined authorization bypass. Mandiant explicitly says the ESG import attacker is unauthenticated. Treat reachability of the management service as exposure; an existing administrator login is not a dependable protection against the ESG chain.

The patch identifiers above are copied from Barracuda, including BNADC-16586 for both ADC and WAF. The firmware range for one CVE does not establish a safe release for every product or replace patch verification. No confirmed attacks, victim count or public exploit are established by these disclosures. This is rated L3 because it affects mainstream perimeter and messaging appliances.