N-able takes N-central platform offline after zero-day dump - TechTarget
N-able took its hosted N-central environment offline Monday after a security researcher disclosed 33 critical zero-day vulnerabilities in the remote monitoring and management platform.
N-able took its hosted N-central environment offline Monday, after a security researcher disclosed 33 critical zero-day vulnerabilities in the remote monitoring and management platform. The company urged enterprise customers running on-premises N-central servers to shut them down until further notice.
In a security alert issued the same day, N-able said it was responding to a "public disclosure and non-responsible communication of critical vulnerabilities in N-central." A GitHub account called 'Oracle-Security' published the research — including vulnerability details, technical write-ups, screenshots and proof-of-concept (PoC) code — on Sunday, Nov. 8.
Chained vulnerabilities
According to threat intelligence firm Previdian, the working PoC demonstrates a full remote code execution chain, from XXE to command execution — a severity echoed by Huntress Labs, which noted the flaws can also be chained for privilege escalation to root.
We have not seen any exploitation attempts across our honeypot network, but we expect that to change quickly.
Although the PoC has been online for hours, it might have only recently come onto attackers' radar, he added. "Once aware, they would need to test and weaponize it, which would take a minimum of a few hours." N-able spokesperson Sarah Toomey confirmed the company is actively responding to the incident.
N-central is an enterprise-grade remote monitoring and management and unified endpoint management platform from N-Able. The Burlington, Mass.-based company's AI-powered cybersecurity platform delivers business resilience to more than 500,000 organizations worldwide. The company said in its security incident notification that it expects to release a hot fix soon.
Related
