N-able releases security hotfixes for zero-day vulnerabilities

N-able, a provider of remote monitoring and management services, has taken its N-central cloud platform offline following the public disclosure of 33 zero-day vulnerabilities by security researcher Sean Bales. The vulnerabilities, which include remote code execution flaws, pose a critical threat as they could allow attackers to take control of affected systems. This move affects N-central's hosted environments, and on-premises customers have been advised to shut down their servers as a precaution.

The disclosed vulnerabilities were demonstrated using a pre-release version of N-central, but Bales believes they affect earlier versions as well. The flaws include authentication bypasses, credential disclosure, arbitrary file writes, directory traversal, cross-site scripting, XML external entity injection, and remote code execution. One critical exploit chain allows an unauthenticated attacker to steal a session, reset passwords, and execute commands on the server, potentially leading to rogue administrative access.

In response to the disclosure, N-able confirmed that it is developing a hotfix to address the vulnerabilities. The company has taken its hosted N-central environments offline across multiple regions as a precautionary measure. While N-able has not observed active exploitation of these vulnerabilities, it acknowledged scanning activity associated with the published proof-of-concept code. The company is working to implement necessary remediation and plans to provide regular updates to its customers.

Bales released the vulnerabilities without prior notification to N-able, citing a lack of response to previous vulnerability reports he submitted for a different N-able product. He claims that these earlier vulnerabilities remain unpatched, and his decision to disclose the N-central issues was influenced by what he perceives as the company's inadequate handling of vulnerability disclosures. N-able has not addressed these specific allegations but has emphasized its commitment to customer security.

Security firms have reported observing exploitation attempts against N-able N-central honeypots following the disclosure. These attempts include probing for the zero-days and opening anonymous agent sessions. Despite this activity, N-able maintains that there is no evidence of successful exploitation in customer environments. The company has released an update to address some of the vulnerabilities and plans further updates to enhance security.