N-able takes cloud platform offline after 30+ 'zero-days' published
N-able takes its cloud platform offline after security researcher disclosed 30+ vulnerabilities, including remote code execution and privilege escalation flaws.
Intelligence analysis by Qwen 2.5 (3B)
Security researcher Sean Bales disclosed 30+ vulnerabilities in N-able's N-central platform, prompting the company to take its cloud services offline and develop a hotfix.
A security researcher found 30+ hidden problems in a software tool used by companies to manage their computers. The company decided to stop using the tool until they can fix the problems.
Analysis
{"#N-able's Response":"N-able took its hosted N-central environments offline across the Americas, Europe, and Asia-Pacific regions after the disclosure. The company confirmed it is developing a hotfix to address the security issues and has not observed active exploitation of the vulnerabilities. N-able also mentioned that Ecoverse services accessed through N-able Login remain operational.","#Vulnerability Details":"The disclosed vulnerabilities include authentication bypasses, credential disclosure, arbitrary file writes, directory traversal, cross-site scripting (XSS), XML external entity (XXE) injection, and remote code execution (RCE) flaws. One of the most critical exploits involves an unauthenticated XXE vulnerability in N-central's service-import functionality, allowing attackers to steal a trusted local session, reset an account password, and execute commands on the server as the nable user.","#Previous Vulnerability Reports":"The security researcher, Sean Bales, claims that previous vulnerability reports were ignored by N-able, leading to the publication of the 30+ 'zero-days'. He also alleges that N-able executives contacted him after the disclosure and asked him to remove the GitHub repository and work with the company."}
Key points
- N-able took its N-central cloud platform offline after a security researcher disclosed 30+ vulnerabilities
- The vulnerabilities include remote code execution and privilege escalation flaws
- N-able is developing a hotfix to address the security issues
The hotfix developed by N-able should address the vulnerabilities and bring the tool back online. This incident highlights the importance of timely vulnerability disclosure and prompt remediation.
If the vulnerabilities were exploited, it could have allowed attackers to take control of computers and networks, causing significant damage to affected companies.
