The vulnerability is an OS command injection flaw stemming from improper neutralization of shell metacharacters in the timezone configuration field of certain Barracuda appliance products. An authenticated administrator can craft a malicious timezone value that, when processed, executes arbitrary shell commands with root privileges. The high CVSS score of 8.6 reflects the ability for the attacker to gain full control of the affected system.

Affected vendors include Barracuda Networks, impacting the Email Security Gateway, Load Balancer Application Delivery Controller, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway. No version specifics were provided; thus the scope extends to all currently deployed firmware releases of these products.

The risk remains high given the CVSS score and the fact that the flaw can be exploited by anyone with authenticated administrative access; the system executes the malicious input with root privileges. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, but the lack of exploitation metrics does not diminish the severity of the flaw. The likely attack vector is through the management interface where administrators input the timezone configuration.