The vulnerability in Barracuda Email Security Gateway versions prior to firmware 9.4.0.030 permits any unauthenticated remote user to invoke the configuration‑import API without proper authentication. By supplying a specially crafted backup archive that matches the appliance’s configuration schema, an attacker can overwrite the global settings, effectively taking complete control of the device. This flaw is a failure of authentication (CWE‑288) and can lead to the modification of security policies, disruption of mail flow, or the establishment of persistence mechanisms.

All Barracuda Email Security Gateway (ESG) models running firmware earlier than 9.4.0.030 are vulnerable. Any deployment that exposes the configuration‑import endpoint to a network—whether on‑premises or cloud‑based—can be exploited, regardless of the gateway’s physical location or the overall network segmentation.

With a CVSS score of 9.3, the flaw is classified as critical. The EPSS score is not available, but the lack of an authentication requirement means an attacker only needs network access to the configuration‑import endpoint. Because management interfaces of ESGs are often exposed to external management networks or the internet, the likelihood of exploitation is high. The vulnerability is not listed in the CISA KEV catalog, yet its critical nature and straightforward attack path make it a top-priority risk.