Multiple appliances sold by Barracuda contain undocumented usernames and passwords, as well as SSH access functionality, which an attacker could use to gain shell-level access to devices.