Vulnerability Details CVE-2017-6320
A remote command injection vulnerability exists in the Barracuda Load Balancer product line (confirmed on v5.4.0.004 (2015-11-26) and v6.0.1.006 (2016-08-19); fixed in 6.1.0.003 (2017-01-17)) in which an authenticated user can execute arbitrary shell commands and gain root privileges. The vulnerability stems from unsanitized data being processed in a system call when the delete_assessment command is issued.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.328
EPSS Ranking 96.6%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 9.0
References
Products affected by CVE-2017-6320
-
cpe:2.3:a:barracuda:load_balancer_adc:5.2.0.004
-
cpe:2.3:a:barracuda:load_balancer_adc:5.3.0.002
-
cpe:2.3:a:barracuda:load_balancer_adc:5.3.0.003
-
cpe:2.3:a:barracuda:load_balancer_adc:5.4.0.003
-
cpe:2.3:a:barracuda:load_balancer_adc:5.4.0.004
-
cpe:2.3:a:barracuda:load_balancer_adc:6.0.0.004
-
cpe:2.3:a:barracuda:load_balancer_adc:6.0.0.005
-
cpe:2.3:a:barracuda:load_balancer_adc:6.0.0.008
-
cpe:2.3:a:barracuda:load_balancer_adc:6.0.1.005
-
cpe:2.3:a:barracuda:load_balancer_adc:6.0.1.006