# MA-1008.012024: MyCERT Advisory - Critical Zero-Day Flaw in Barracuda Email Security Gateway

**Date:** 14 Jan 2024  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-1008.012024  
**Advisory ID:** MA-1008.012024

---

**1.0 Introduction**
MyCERT has observed a Critical Zero-Day Flaw in Barracuda Email Security Gateway that allows attackers to execute arbitrary code on vulnerable devices.
**2.0 Impact**
This vulnerability allows attackers to execute arbitrary code on vulnerable devices, potentially leading to complete system compromise, data theft, and disruption of email flow.
- Remote code execution on vulnerable devices
- Deployment of malware (SEASPY, SALTWATER)
- Unauthorized data access or exfiltration
- Disruption of email flow and security
**3.0 Affected Products**
Barracuda Email Security Gateway (ESG) appliances.
**4.0 Indicators of Compromise (IoC)**
- CVE ID: CVE-2023-7102
- Type: Arbitrary Code Execution (ACE)
- Location: Spreadsheet::ParseExcel library used by Amavis virus scanner in Barracuda ESG
- Active exploitation is reported and Barracuda Patched the vulnerability (CVE-2023-7102) in all active ESGs. The patch has been automatically deployed and deployed a patch to remediate compromised ESG devices exhibiting indicators of compromise (IOCs) 
- CVE-2023-7101 to raise awareness of the underlying ACE vulnerability in Spreadsheet::ParseExcel. This vulnerability remains unpatched in the open-source library.
|  |  | --- | --- | --- | --- | Malware | MD5 Hash | SHA256 | File Name(s) | CVE-2023-7102 XLS Document | 2b172fe3329260611a9022e71acdebca | 803cb5a7de1fe0067a9eeb220dfc24ca 56f3f571a986180e146b6cf387855bdd | ads2.xls | CVE-2023-7102 XLS Document | e7842edc7868c8c5cf0480dd98bcfe76 | 952c5f45d203d8f1a7532e5b59af8e330 6b5c1c53a30624b6733e0176d8d1acd | don.xls | CVE-2023-7102 XLS Document | e7842edc7868c8c5cf0480dd98bcfe76 | 952c5f45d203d8f1a7532e5b59af8e330 6b5c1c53a30624b6733e0176d8d1acd | personalbudget.xls | SEASPY | 7b83e4bd880bb9d7904e8f553c2736e3 | 118fad9e1f03b8b1abe00529c61dc3edf da043b787c9084180d83535b4d177b7 | wifi-service | SALTWATER | d493aab1319f10c633f6d223da232a27 | 34494ecb02a1cccadda1c7693c45666e1 fe3928cc83576f8f07380801b07d8ba | mod\_tll.so |  | --- | IP Address | 23.224.99.242 | 23.224.99.243 | 23.224.99.244 | 23.224.99.245 | 23.224.99.246 | 23.225.35.234 | 23.225.35.235 | 23.225.35.236 | 23.225.35.237 | 23.225.35.238 | 107.148.41.146 |
**5.0 Recommendations**
MyCERT recommends system administrators and users to :
- Stay informed about updates from Barracuda.
- Monitor ESG devices for signs of suspicious activity.
- Monitor for indicators of compromise (IOCs) provided by Barracuda.
- Enforce strong password policies and access controls.
- Review CVE-2023-7101 and implement mitigations as no patch is currently available.
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**6.0    References**
<https://www.barracuda.com/company/legal/esg-vulnerability>