CVE-2019-5648: Barracuda Load Balancer ADC Firmware

Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days.

Authenticated, administrative access to a Barracuda Load Balancer ADC running unpatched firmware <= v6.4 allows one to edit the LDAP service configuration of the balancer and change the LDAP server to an attacker-controlled system, without having to re-enter LDAP credentials. These steps can be used by any authenticated administrative user to expose the LDAP credentials configured in the LDAP connector over the network.

Affected products

• Barracuda Load Balancer ADC Firmware: up to and including 6.4

Published 2020-03-12. Last modified 2026-06-17.