International
The Morning Dev

Only the news worth knowing

‹
 
B45/100

Vulnerability · critical

N-able N-central zero-day flaws: product taken offline and hotfixes released

Tier B · Patch this week – Put it in the sprint

Who’s exposed: Organizations running N-able N-central, including on-premises and hosted customers

Tier B because: Exploited in the wild OR public exploit

Reach

Attack

Damage

Fix

Popular tool · Public exploit · Full takeover

What to do

  1. Follow N-able guidance and shut down on-premises N-central servers until further notice, as urged by N-able
  2. Check for the status of hosted N-central environments before relying on them

The Brief

  • N-able took its hosted N-central environments offline after a researcher publicly disclosed more than 30 vulnerabilities collectively tracked as Able2Shell.
  • N-able urged on-premises customers to shut down their N-central servers until further notice as a precautionary measure.
  • Sources describe possible remote code execution, credential theft, and administrator account creation, and the disclosure included PoC exploits.

Why it matters

N-central is a remote monitoring and management platform, so a compromise could give attackers reach into the systems and customers it manages. Teams running N-central need to assess their exposure now.

The checklist behind the tier

Checklist · 4 of 10 yes
YesHits tech teamsN-central is an RMM platform that IT teams and MSPs run and depend on daily.
NoCore infrastructureJudgment: a single vendor's RMM product, not software nearly every team runs.
YesPopular toolJudgment: N-central is a widely deployed RMM platform used by many MSPs and IT teams.
NoExploited in the wildTechCrunch says the company feared possible cyberattacks; no source reports observed attacks.
YesPublic exploitThe Hacker News: researcher disclosed 33 zero-days with PoC exploits.
NoRemote, no loginSources describe remote code execution but do not say unauthenticated access suffices.
YesFull takeoverSecurityWeek: attackers could exploit flaws for remote code execution and administrator account creation.
NoSecrets exposedNo source reports stolen credentials, tokens, configs or customer data.
NoSupply chainSources describe vulnerabilities in N-central, not malicious code shipped through a trusted channel.
NoNo fix yetNo source states that a patched version is unavailable.

Timeline

  1. N-able announces it is responding to the public disclosure of critical vulnerabilities in N-central and takes hosted environments offline

  2. BleepingComputer

    N-able takes cloud platform offline after 30+ "zero-days" published

  3. Coverage reports N-able urging on-premises customers to shut down their servers after the disclosure of over 30 zero-days

  4. The Hacker News

    N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploits

  5. SecurityWeek

    N-able Takes N-central Offline as Researcher Drops Over 30 Zero-Days

  6. Rapid7 Cybersecurity Blog

    Critical vulnerabilities in N-able N-central prompt hosted shutdown

  7. TechCrunch

    N-able takes its remote access service offline after researcher publishes dozens of zero-day bugs

  8. BleepingComputer

    N-able releases security hotfixes for zero-day vulnerabilities

Full coverage · 6 sources

First seen · 6 sources · Full story page · How tiers are decided