CVE-2023-7102

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 44.58%
EPSS Percentile: 98.74%
CISA KEV: Not listed

Description

Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: mandiant-cve@google.com
Published: 25-Dec-2023 05:15
Last Modified: 17-Jun-2026 13:52
EPSS Date: 2026-10-10
CWE: CWE-1104

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

barracuda / email_security_gateway_300_firmware
Version / affected range: * · from (inclusive) 5.1.3.001 · through (inclusive) 9.2.1.001
cpe:2.3:o:barracuda:email_security_gateway_300_firmware:*:*:*:*:*:*:*:*
barracuda / email_security_gateway_400_firmware
Version / affected range: * · from (inclusive) 5.1.3.001 · through (inclusive) 9.2.1.001
cpe:2.3:o:barracuda:email_security_gateway_400_firmware:*:*:*:*:*:*:*:*
barracuda / email_security_gateway_600_firmware
Version / affected range: * · from (inclusive) 5.1.3.001 · through (inclusive) 9.2.1.001
cpe:2.3:o:barracuda:email_security_gateway_600_firmware:*:*:*:*:*:*:*:*
barracuda / email_security_gateway_800_firmware
Version / affected range: * · from (inclusive) 5.1.3.001 · through (inclusive) 9.2.1.001
cpe:2.3:o:barracuda:email_security_gateway_800_firmware:*:*:*:*:*:*:*:*
barracuda / email_security_gateway_900_firmware
Version / affected range: * · from (inclusive) 5.1.3.001 · through (inclusive) 9.2.1.001
cpe:2.3:o:barracuda:email_security_gateway_900_firmware:*:*:*:*:*:*:*:*

References

Last enrichment sync: 11-Oct-2026 12:57
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

two different vulnerabilities in Barracuda Email Security Gateway (ESG) appliances (CVE-2023-2868 and CVE-2023-7102) to deliver persistent backdoors. Linux Backdoors Masquerade as Email Security Tools on South Korean and Taiwanese Appliances

CVE (1)

Malware (3)

Threat Actors (9)

MITRE ATT&CK (3)

Vendors (2)

Products (4)

Tools (3)

Industries (1)

Countries (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.