Hackers now exploit critical Barracuda ESG flaws to gain root access

What happened?

Cybersecurity company Barracuda Networks warned that attackers have begun exploiting two recently patched Email Security Gateway (ESG) vulnerabilities that let them run commands with root privileges. [...]

Key details

• The first vulnerability is an authentication weakness allowing modification of the appliance's global configuration.
• Successful exploitation requires access to the administrative user interface of the targeted device.
• When combined, the flaws can bypass authorization controls and grant root access to the device.
• Barracuda recommends enabling automatic patching to ensure devices receive updates promptly.

Summarised by SecOraLens from BleepingComputer. Always read the original source before acting. How SecOraLens verifies advisories.