The vulnerability CVE-2025-34393 in Barracuda Networks RMM prior to version 2025.1.1 involves unsafe reflection due to improper validation of attacker-controlled WSDL service names in the Barracuda Service Center. This allows an attacker to execute remote code by invoking arbitrary methods or deserializing untrusted types. The issue is classified under CWE-470. The CVSS 4.0 score of 10 reflects a critical risk with network attack vector, no required privileges or user interaction, and severe impact on confidentiality, integrity, and availability. The product is not a cloud service, and no patch links or vendor advisories confirming remediation are currently available.

Successful exploitation can lead to remote code execution on the affected system, compromising confidentiality, integrity, and availability. This could allow attackers to execute arbitrary code remotely without authentication or user interaction. There are no known exploits in the wild reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the affected service and monitor for suspicious activity related to WSDL service interactions. Avoid exposing the Barracuda Service Center to untrusted networks. Apply the official patch promptly once it becomes available.