N-able takes hosted N-central offline after 30-plus zero-day drop
Original title: N-able Takes N-central Offline as Researcher Drops Over 30 Zero-Days
Sean Bales published Able2Shell proof-of-concept code; N-able reports no exploitation and expects a hotfix around midday November 10.
Researcher Sean Bales published more than 30 alleged N-central zero-days on GitHub on Sunday, before any CVE assignment. He says they allow remote code execution as nable or root, arbitrary commands, unauthorized administrative accounts, and leaks of configurations and credentials, plus four exploit chains to the same result. N-able took hosted N-central offline Monday while validating a fix and told customers to keep on-premises deployments offline until patches ship.
Unconfirmed: The flaws are alleged zero-days without CVE identifiers, and N-able says it has no evidence they were exploited.
- Bales calls the flaws Able2Shell and released proof-of-concept code for each.
- N-able says the hotfix work was on track with no setbacks.
- The company says it has no evidence of exploitation in its environments.
- Bales says he published after N-able did not patch flaws in another product.
Impact: Remote code execution as nable or root, plus credential and config leaks
| Product | Affected |
|---|---|
| N-able N-central | — |
- 1.Keep on-premises N-central offline until N-able releases patches.
- 2.Treat hosted N-central as unavailable while N-able remediates.
From the original article
1 min read at securityweek.com
Attackers could exploit the flaws for remote code execution, credential theft, and administrator account creation. The post N-able Takes N-central Offline as Researcher Drops Over 30 Zero-Days appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.