CVE-2023-2868

Successful exploitation permits unauthorized system-command execution with administrator privileges on the ESG appliance. Observed intrusions involved reverse shells, persistent backdoors, email monitoring, credential harvesting, and exfiltration of email data and certificates. Compromised appliances were also used as entry points into other systems within victim networks. Established persistence could survive application of the vulnerability patch, leaving previously exploited appliances at risk of continued compromise.

Immediately isolate compromised appliances and discontinue their use pending replacement. Review email and network logs, preserve forensic appliance images, and conduct network-wide compromise assessment rather than relying exclusively on appliance-level indicator scanning. Monitor for use of credentials exposed on affected appliances. Scan and remove suspicious email attachments and verify actual attachment types rather than relying on filename extensions; these measures do not substitute for patching and replacement of compromised appliances.

Apply and verify Barracuda security patch BNSF-36456, which was automatically deployed to customer appliances to address the command injection flaw. Patching alone does not establish that an exploited appliance is trustworthy: isolate and replace impacted appliances as soon as possible, regardless of patch level, coordinating replacement with Barracuda support. Investigate the surrounding environment for persistence, lateral movement, data exfiltration, and compromised email accounts. Revoke and rotate all local and domain credentials present on compromised appliances, and revoke and reissue certificates present at the time of compromise.