N-able took its hosted N-central environment offline Monday, after a security researcher disclosed 33 critical zero-day vulnerabilities in the remote monitoring and management platform.
The company urged enterprise customers running on-premises N-central servers to shut them down until further notice.
In a security alert issued the same day, N-able said it was responding to a “public disclosure and non-responsible communication of critical vulnerabilities in N-central.”
A GitHub account called ‘Oracle-Security’ published the research — including vulnerability details, technical write-ups, screenshots and proof-of-concept (PoC) code — on Sunday, Nov. 8.
The repository is owned by a researcher operating under the handle BinaryNinja, who also posted details of the flaws on social media.
N-able spokesperson Sarah Toomey confirmed the company is actively responding to the incident.
“At this time, we have not observed active exploitation of these vulnerabilities,” she told TechTarget Cybersecurity.
Chained vulnerabilities
According to threat intelligence firm Previdian, the working PoC demonstrates a full remote code execution chain, from XXE to command execution — a severity echoed by Huntress Labs, which noted the flaws can also be chained for privilege escalation to root.
“We have not seen any exploitation attempts across our honeypot network, but we expect that to change quickly,” Ryan Dewhurst, vulnerability researcher and founder at Previdian, told TechTarget Cybersecurity on Monday afternoon.
Although the PoC has been online for hours, it might have only recently come onto attackers’ radar, he added. “Once aware, they would need to test and weaponize it, which would take a minimum of a few hours.”
N-central is an enterprise-grade remote monitoring and management and unified endpoint management platform from N-Able. According to promotional material, the Burlington, Mass.-based company’s AI-powered cybersecurity platform delivers business resilience to more than 500,000 organizations worldwide.
The company said in its security incident notification that it expects to release a hot fix soon.
