Covered by 2 outlets — first reported by BleepingComputer, Nov 12, 19:51 UTC
New N-able "4EverAble2Shell" zero-day exploited hours after PoC released
Summary
Attackers are exploiting a newly disclosed zero-day (a flaw exploited before a fix existed) in N-able's N-central remote management platform, dubbed 4EverAble2Shell, hours after a proof-of-concept exploit was published. SecurityWeek says the flaw could let a remote, unauthenticated attacker run code with root privileges. BleepingComputer reports researchers have seen at least 21 affected systems, 19 of them running the company's latest security update, and that attackers are deploying cryptocurrency miners.
AI summary by the SecurityTabs newsroom, checked against BleepingComputer, SecurityWeek. Read the outlets below for the full story.
Continue reading
2 outlets, in the order they reported it.
BleepingComputerFirst report
New N-able "4EverAble2Shell" zero-day exploited hours after PoC released
Hackers are actively exploiting a newly disclosed N-able N-central zero-day vulnerability dubbed "4EverAble2Shell" to compromise servers and deploy cryptocurrency miners, with researchers reporting at least 21 affected systems, including…
SecurityWeek
Hackers Exploit New N-central Zero-Day Hours After PoC Publication
Dubbed 4EverAble2Shell, the flaw could allow remote, unauthenticated attackers to execute code with root privileges.
Explained
The technology and terms in this story. Learn more
- ConceptZero-dayA flaw attackers exploit before the vendor has a fix: defenders have had zero days to patch.
- ConceptProof of conceptA demonstration that a flaw can be exploited, usually published by researchers.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.