N-able Takes N-central Offline After Researcher Discloses 30-Plus Alleged Zero-Days
Summary
N-able took hosted N-central offline after researcher Sean Bales disclosed more than 30 alleged zero-days. The company said it had no evidence of exploitation and expected a hotfix around midday November 10.
Key points
- Researcher Sean Bales published more than 30 alleged N-central zero-days, which he named Able2Shell; they have no CVE identifiers yet.
- Bales says the flaws could enable remote code execution, arbitrary commands, unauthorized admin accounts, or exposure of configuration and credential data.
- The researcher published proof-of-concept code for each flaw and described four exploit chains.
- N-able took its hosted N-central environment offline and advised keeping on-premises deployments offline until patches are released.
- N-able said it had no evidence that the vulnerabilities had been exploited against its N-central environments.
- The company said its hotfix and validation work were progressing, with rollout expected around midday November 10.
Article Details
- Vulnerability Types
- Remote code execution
- Arbitrary command execution
- Unauthorized administrative account creation
- Sensitive data disclosure
- Exploitation Status
- not_reported
- Exploit Availability
- public_poc
- Patch Status
- unavailable
- Workarounds
- Keep on-premises N-central deployments offline until patches are released.