CVE-2005-2847: Barracuda Spam Firewall img.pl command injection via f parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityUnauthenticated remote command execution on an internet-facing security appliance with public exploit code and very high EPSS probability.

What it is

The img.pl script in Barracuda Spam Firewall firmware 3.1.16 and 3.1.17 passes the f parameter to a shell without sanitizing shell metacharacters, allowing command injection. Because the endpoint is network-reachable and requires no authentication, this is a serious pre-auth remote code execution flaw on a perimeter security appliance.

Impact

An unauthenticated remote attacker can execute arbitrary commands on the appliance, gaining control of the device and potentially pivoting into the internal network it protects.

Attack surface

Reached over the network via HTTP requests to img.pl with crafted shell metacharacters in the f parameter; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV, but EPSS is 0.53375 (99th percentile) and multiple references are tagged Exploit, indicating public exploit code exists and exploitation is likely.

What to do

• Apply the vendor patch referenced in the Secunia and SecurityFocus advisories; upgrade firmware beyond 3.1.16/3.1.17.
• If patching is not immediately possible, restrict network access to the appliance management/web interface to trusted administrative hosts only.
• Place the appliance behind a filtering reverse proxy or WAF rule that blocks shell metacharacters in requests to img.pl.
• Monitor and audit the appliance for signs of compromise and rotate any credentials stored on it.

Detection

• Inspect HTTP request logs for img.pl requests containing shell metacharacters (;, |, `, $(), &&) in the f parameter.
• Monitor for unexpected child processes or shell execution spawned by the web server process on the appliance.
• Alert on outbound connections from the appliance to unusual destinations that could indicate command-and-control or data exfiltration.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.