Impact Analysis

The vulnerability allows an attacker with local access to escalate their privileges to SYSTEM level.

This means the attacker can execute arbitrary code with the highest privileges on the system, potentially leading to full system compromise.

Such control can be used to steal sensitive data, disrupt services, install malware, or create persistent backdoors.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Barracuda RMM versions prior to 2025.2.2 and involves privilege escalation.

Local attackers can exploit overly permissive filesystem access control lists (ACLs) on the C:\Windows\Automation directory.

By modifying existing automation content or placing attacker-controlled files in this directory, attackers can have their code executed with SYSTEM-level privileges during routine automation cycles.

This typically happens within the next execution cycle, allowing attackers to gain high-level control over the affected system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking the permissions on the C:\Windows\Automation directory to see if they are overly permissive, allowing local users to modify or add files.

Suggested commands to detect this issue include checking the Access Control Lists (ACLs) on the directory using Windows command line tools.

• Use the command: icacls C:\Windows\Automation to view the current permissions on the directory.
• Look for permissions that allow modification or write access to non-administrative users.
• Additionally, review any files in this directory that may have been recently modified or added by unauthorized users.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting the permissions on the C:\Windows\Automation directory to prevent unauthorized modification.

• Modify the ACLs to allow only trusted administrative accounts to have write or modify permissions.
• Remove any unauthorized or suspicious files from the directory.
• Upgrade Barracuda RMM to version 2025.2.2 or later, where this vulnerability is fixed.

Useful 0 Not Useful 0