security

Someone's fishing for exposed devices

Security company Barracuda warns that attackers are exploiting a pre-authentication authorization bypass bug and a command-injection vulnerability in its popular Email Security Gateway (ESG) products that, when chained, could allow the crims to run commands with root privileges.

“We have identified exploitation activity affecting a small number of organizations,” the security vendor said in a late Monday night update to its earlier security advisory.

Barracuda declined to answer The Register ’s questions, including one about how many organizations have been hit by attackers. A company spokesperson told us that it “worked directly” with the affected businesses “to quickly address the issue.…