CVE-2023-2868
A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of ...
Affects 10 products across 1 vendor.
Software does not validate or incorrectly validates input, allowing attackers to craft data processed in unintended ways.
Attacker injects operating system commands through application inputs passed to a shell or system call.
Show all 57
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
A critical remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only), affecting versions 5.1.3.001-9.2.0.006. The vulnerability allows a remote attacker to execute arbitrary commands on the system by manipulating the names of files within a .tar archive. The issue was fixed in BNSF-36456, which was automatically applied to all customer appliances. Given the high CVSS score and the availability of a public proof-of-concept, immediate attention is required to ensure the security of affected systems.
BSID: BS-2023-GLOBAL-261836-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2023-2868?
What is the CVSS score for CVE-2023-2868?
Is CVE-2023-2868 actively exploited?
How do I remediate CVE-2023-2868?
What systems are affected by CVE-2023-2868?
What NERC-CIP standard applies to CVE-2023-2868?
What IEC 62443 requirement maps to CVE-2023-2868?
| CVE ID | CVE-2023-2868 |
|---|---|
| BSID | BS-2023-GLOBAL-261836-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2023-05-24 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 15% |
| Weakness (CWE) | |
| Source | NVD |
A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.
Source: NIST NVD / MITRE CVE Database
The vulnerability arises from incomplete input validation of user-supplied .tar files. Specifically, the names of the files within the archive can be crafted to trigger the execution of system commands via Perl's qx operator. This allows a remote attacker to gain control over the Email Security Gateway with the privileges of the application, leading to potential data exfiltration, system compromise, and further lateral movement within the network.
Exploitation Likelihood: CRITICAL
| Vendor | Product | Affected Versions |
|---|---|---|
| Barracuda | Email Security Gateway 300 (device & firmware) | ≥ 5.1.3.001, ≤ 9.2.0.006 |
| Barracuda | Email Security Gateway 400 (device & firmware) | ≥ 5.1.3.001, ≤ 9.2.0.006 |
| Barracuda | Email Security Gateway 600 (device & firmware) | ≥ 5.1.3.001, ≤ 9.2.0.006 |
| Barracuda | Email Security Gateway 800 (device & firmware) | ≥ 5.1.3.001, ≤ 9.2.0.006 |
| Barracuda | Email Security Gateway 900 (device & firmware) | ≥ 5.1.3.001, ≤ 9.2.0.006 |
| CISA known-exploited | ● Active Exploitation Confirmed (added 2023-05-26) |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Implement strict input validation and sanitization for all file uploads, especially for .tar files. Ensure that file names do not contain malicious characters or sequences that could be interpreted as commands. Additionally, consider deploying a web application firewall (WAF) to monitor and block suspicious traffic.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.
This CVE violates CIP-007-R2 because it allows unauthorized access to the system, which could lead to the compromise of critical cyber assets and the disruption of power delivery.
This CVE maps to SR 7.6 because it involves a vulnerability that can be exploited to execute arbitrary code on the system, which could compromise the integrity and availability of the industrial control system.
Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.
AI Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 49eb337cd9a42ad26493ae8f5992b8594e0a72b6cdb1e7bc667090124c8f35b6cde28a990f9df7d1ddd36b68725aebf8d38be9e21cc6cb514a48bda956801e21 |
This Vulnerability Is Being Actively Exploited
CVE-2023-2868 is on the CISA known-exploited list - confirmed active exploitation in the wild. BreachSpider flags known-exploited CVEs on the ICS assets they affect, with known-exploited status synced daily from CISA.
Create a free account →