Barracuda Urges Replacing | Not Patching | Its Email Security Gateways
Summary: Barracuda Networks told customers to physically replace, not patch, its Email Security Gateway appliances after a zero-day (CVE-2023-2868) in the attachment-scanning component was exploited starting in October 2022. Barracuda hired Mandiant on May 18, patched on May 20, and by June 6 said impacted appliances must be replaced regardless of patch level, with roughly 5% of active ESG devices worldwide showing indicators of compromise and about 11,000 vulnerable units still internet-connected.
Why it matters: Attackers held persistent backdoor access and exfiltrated data on some appliances for months, and Rapid7's Caitlin Condon said the pivot to full replacement implies the malware persists below the level a wipe would reach - meaning email flowing through an infected gateway may already have been read by a state actor.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-2868
- Related
- CVE-2023-2868: Barracuda Networks ESG Appliance Improper Input Validation Vulnerability Known Exploited Vulnerabilities · May 26, 2023