CVE-2023-7102

The vulnerability originates from a Perl library called Spreadsheet-ParseExcel, used by Barracuda ESG software to process Excel files. Improper handling of input data in this library enables parameter injection through a specially crafted Excel file. An attacker can deliver a malicious file (e.g., as an email attachment), which is automatically processed by the gateway, triggering the exploit without any user interaction.

An unauthenticated remote attacker can gain full control over the device — confidentiality, integrity, and availability of the system are compromised at a critical level.

Barracuda removed the vulnerable logic from the device. Ensure that ESG devices have received an update that eliminates this component — details are available in the Barracuda Networks security notice at: https://www.barracuda.com/company/legal/esg-vulnerability. Patches provided by the vendor should be applied according to the references.

Barracuda ESG Appliance in versions from 5.1.3.001 to 9.2.1.001 (models 300, 400, 600 and others covered by this firmware line), until the vulnerable logic is removed by Barracuda Networks.