CVE-2023-7102

Remote Code Execution (RCE) Vulnerability

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.19.8Critical EPSS percentile99th45% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 2 sources FixVendor fixNo build named by the sources

Published 2023-12-24Updated 2024-11-21Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Barracuda Networks Inc. Barracuda ESG ApplianceAffected: ≥ 5.1.3.001, ≤ 9.2.1.001Upgrade to: after 9.2.1.001Stated by: CVE record
Barracuda Email Security Gateway 300 FirmwareAffected: ≥ 5.1.3.001, ≤ 9.2.1.001Upgrade to: after 9.2.1.001Stated by: NVD
Barracuda Email Security Gateway 400 FirmwareAffected: ≥ 5.1.3.001, ≤ 9.2.1.001Upgrade to: after 9.2.1.001Stated by: NVD
Barracuda Email Security Gateway 600 FirmwareAffected: ≥ 5.1.3.001, ≤ 9.2.1.001Upgrade to: after 9.2.1.001Stated by: NVD
Barracuda Email Security Gateway 800 FirmwareAffected: ≥ 5.1.3.001, ≤ 9.2.1.001Upgrade to: after 9.2.1.001Stated by: NVD

Versions as the sources state them. 3 more products have version data. Full version matrix after sign-in

Steps

Written by AI from the record

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic.

In plain language

Written by AI from the record

This flaw lets an attacker take full control of a Barracuda email security appliance over the network without logging in, and because working exploit tools already exist publicly, every affected device should be treated as at risk right now.

Unauthenticated remote code execution in Barracuda ESG Appliance (5.1.3.001–9.2.1.001) stemming from parameter injection in the bundled Spreadsheet::ParseExcel third-party library, with public PoCs and a Metasploit module available and EPSS predicting high exploitation likelihood (44.6%, 99th percentile, rising).

If you're affected

Full appliance takeover
Email traffic interception
Internal network pivot point
Operational email outage
Data exfiltration from gateway

What is it

Think of this appliance as the mail room guard for your business email. This flaw is like leaving a hidden back door in that guard's office — someone outside, without ever showing ID, can walk in, take over the guard's desk, and from there reach into your mail and your wider network.

Who is affected

This matters to you if you run a Barracuda Email Security Gateway appliance (ESG, including the 300/400/600/800/900 firmware lines) on versions between 5.1.3.001 and 9.2.1.001, or if you separately use the Spreadsheet::ParseExcel software library in your own systems. The appliance is a network-facing device, so it is reachable to attackers by design — no internal access or stolen login is needed to exploit it.

How urgent is it

This is a critical, high-urgency situation: ready-to-use attack tools, including public proof-of-concept code and a Metasploit module, are already circulating, and researchers report rising attention including from an actor known as Red Menshen. While no confirmed real-world breach has been publicly reported yet, the combination of no login requirement, public exploit tooling, and rising attacker interest means you should act now, not wait for confirmation of an attack.

What to do — in detail

Inventory all Barracuda ESG appliances (300/400/600/800/900 series) and confirm firmware version against the vulnerable range 5.1.3.001–9.2.1.001. 2) Apply Barracuda's remediation as documented at https://www.barracuda.com/company/legal/esg-vulnerability — Barracuda states the vulnerable logic has been removed via their update process, so confirm the device has received this update rather than relying on a version-number check alone. 3) Separately audit any custom code or integrations that use the Spreadsheet::ParseExcel Perl library and upgrade to release CPAN_0.66 or later (https://github.com/jmcnamara/spreadsheet-parseexcel/releases/tag/CPAN_0.66). 4) There is no documented safe workaround beyond network isolation — if patching is delayed, block inbound access to the appliance's management/processing interfaces from untrusted networks. 5) No CISA KEV due date applies since this CVE is not currently listed in KEV. 6) Monitor for unusual outbound connections or process execution from the appliance, and watch for new Metasploit-based scanning activity given the module's public availability and rising EPSS trend.

Technical context

CVSS 3.1 score 9.8 (Critical), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-exploitable, no privileges or user interaction required, full compromise of confidentiality, integrity and availability. Root cause is CWE-1104 (use of unmaintained third-party components) via parameter injection in the bundled Spreadsheet::ParseExcel library. Not currently listed in CISA KEV and no dated confirmed in-the-wild exploitation reported, but two public PoC exploits exist on GitHub and a Metasploit module has been built, indicating high exploit maturity. EPSS is 44.6% (99th percentile) and rising, reflecting elevated predicted exploitation likelihood consistent with the available tooling.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

2 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

45% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 471 days before any public exploit.

2026-06-25OpenVAS check added
2026-06-22EPSS band changehigh → moderate
2026-05-25EPSS band changelow → high
2026-03-06Public exploit / PoCsource: github-poc
2024-11-21Patch availablerecord updated
2023-12-24Publishedweakness classified, att&ck mapped

Affected products

barracudacommercialaka email security gateway 400 firmware, rmm, email security gateway 300 firmware
Comprehensive Perl Archive Network(CPAN)oss-projectaka cpan, comprehensive perl archive network
- Spreadsheet::ParseExcelLibraryOSS Libraries / generic-library
Barracuda Networks, Inc.commercial · USaka barracuda networks
- Email Security GatewayOn-premNetworking Infrastructure / firewall
Barracuda Networks Inc.commercial
- Barracuda ESG ApplianceEmbeddedSecurity Products / secure-gateway-vpn

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable