{"id":"CVE-2023-26213","aliases":["EUVD-2023-30038","GHSA-m789-8jxv-f7m3"],"status":"published","title":"On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891,...","description":"On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injection vulnerability exists in /ajax/update_certificate - a crafted HTTP request allows an authenticated attacker to execute arbitrary commands. For example, a name field can contain :password and a password field can contain shell metacharacters.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.07878,"percentile":0.94784,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2023-03-03T00:00:00Z","modified":"2026-06-17T05:42:50Z","products":[{"vendor":"barracuda","product":"t100b_firmware"},{"vendor":"barracuda","product":"t193a_firmware"},{"vendor":"barracuda","product":"t200c_firmware"},{"vendor":"barracuda","product":"t400c_firmware"},{"vendor":"barracuda","product":"t600d_firmware"},{"vendor":"barracuda","product":"t900b_firmware"},{"vendor":"barracuda","product":"t93a_firmware"}],"references":[{"url":"https://www.barracuda.com/products/network-security/cloudgen-wan","tags":["x_transferred","Product"]},{"url":"http://seclists.org/fulldisclosure/2023/Mar/2","tags":["mailing-list","x_transferred","Exploit","Mailing List","Third Party Advisory"]},{"url":"https://sec-consult.com/vulnerability-lab/advisory/os-command-injection-in-barracuda-cloudgen-wan/","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://campus.barracuda.com/product/cloudgenwan/doc/96024723/release-notes-8-3-1/","tags":["x_transferred","Release Notes"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26213"},{"url":"https://campus.barracuda.com/product/cloudgenwan/doc/96024723/release-notes-8-3-1"},{"url":"https://sec-consult.com/vulnerability-lab/advisory/os-command-injection-in-barracuda-cloudgen-wan"},{"url":"https://github.com/advisories/GHSA-m789-8jxv-f7m3"}],"sources":{"cve":[{"id":"CVE-2023-26213","description":"On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injection vulnerability exists in /ajax/update_certificate - a crafted HTTP request allows an authenticated attacker to execute arbitrary commands. For example, a name field can contain :password and a password field can contain shell metacharacters.","status":"published","published":"2023-03-03T00:00:00Z","modified":"2025-03-07T15:55:49.918Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:35:15.434947Z"}],"euvd":[{"id":"EUVD-2023-30038","description":"On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injection vulnerability exists in /ajax/update_certificate - a crafted HTTP request allows an authenticated attacker to execute arbitrary commands. For example, a name field can contain :password and a password field can contain shell metacharacters.","status":"published","published":"2023-03-03T00:00:00Z","modified":"2025-03-07T15:55:49Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:53:10.661676Z"}],"ghsa":[{"id":"GHSA-m789-8jxv-f7m3","title":"On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891,...","description":"On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injection vulnerability exists in /ajax/update_certificate - a crafted HTTP request allows an authenticated attacker to execute arbitrary commands. For example, a name field can contain :password and a password field can contain shell metacharacters.","status":"published","published":"2023-03-04T00:30:16Z","modified":"2025-03-07T18:31:59Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:00:11.427911Z"}],"nvd":[{"id":"CVE-2023-26213","description":"On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injection vulnerability exists in /ajax/update_certificate - a crafted HTTP request allows an authenticated attacker to execute arbitrary commands. For example, a name field can contain :password and a password field can contain shell metacharacters.","status":"published","published":"2023-03-03T22:15:09.84Z","modified":"2026-06-17T05:42:50.147Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:07:48.342507Z"}]}}