Back Securityweek N-able Takes N-central Offline as Researcher Drops Over 30 Zero
N-able on Monday took hosted N-central environments offline in response to a security researcher’s public disclosure of more than 30 alleged zero-day vulnerabilities.
“As a precautionary measure, we are temporarily taking our Hosted N-central environment offline while we take the necessary actions to secure the environment and implement appropriate remediation,” the company said .
While N-central and the related services remain inaccessible, N-able says it has made progress validating the flaws and creating a fix, which should roll out around midday on November 10.
On-premises N-central deployments should also be kept offline until patches are released, the company says.
“N-able Engineering continues to make progress on the N-central hotfix and associated validation activities. The work remains on track with no setbacks, and our teams are progressing as quickly as possible while maintaining the validation required for a safe remediation,” the company said.
N-able also pointed out that it has no evidence that the vulnerabilities have been exploited against its N-central environments.
The zero-day bugs were published on GitHub on Sunday by security researcher Sean Bales and have yet to be assigned CVE identifiers. Bales dubbed the flaws Able2Shell.
According to the researcher, the weaknesses could be exploited to achieve remote code execution (RCE) with ‘nable’ or root privileges, to execute arbitrary commands, create unauthorized administrative accounts, or leak sensitive data, such as configurations and credentials.
Additionally, Bales describes four exploit chains that could also lead to RCE with ‘nable’ or root privileges.
The security researcher released proof-of-concept (PoC) code targeting every flaw and reportedly explained that the zero-days were dropped after N-able failed to patch security defects he previously reported in another product.
Related: Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH
Related: Cisco, WatchGuard Release Patches; SonicWall Won’t Fix GMS Flaws
Related: Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day
Related: Barracuda ESG Authentication Bypass Flaw Opens Path to Root
Ionut Arghire is an international correspondent for SecurityWeek.
More from Ionut Arghire
Amplifon Americas Data Breach Impacts 1.3 Million
Brava Security Emerges From Stealth With $15 Million in Funding
DigiCert Data Breach Impacts Business Customer Information
US Agencies Urge Organizations to Harden Refrigeration Controllers
Researchers Find Residential Proxies on White House Network
OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass
Bank Phishing Sites Show Fake ‘Suspended’ Pages to Evade Takedowns
Cisco, WatchGuard Release Patches; SonicWall Won’t Fix GMS Flaws
IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks
France Blames Iran for a Cyberattack That Heated Supermarket Refrigerators
Chrome Update Patches Exploited XML Zero-Day, Eighth This Year
Revolve Puts Data Breach Victim Count at 1.5 Million
Plex2Shell Exploited Against QNAP NAS Users
Iris Plaza Breach May Have Exposed Data of 7.7 Million Customers
Italy’s Meloni Blames Pro-Russian Hackers for Leak of Foreign Minister’s Data on the Dark Web
Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH
Flipboard Whatsapp Whatsapp Email
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
