Skip to content
securitytabs

LiveUpdated

N-able takes hosted N-central offline after researcher posts 30+ flaws

N-able, which makes remote management software used by IT providers, has switched off its hosted N-central service after a researcher published details of dozens of unpatched flaws. Customers running N-central on their own servers have been told to shut them down.

N-able N-central taken offline after unpatched flaws published
N-able N-central taken offline after unpatched flaws published

What's new

Newest coverage

TimelineWhat should my organization do?

What happened

N-able says it has taken its hosted N-central environments offline and urged on-premises customers to shut down their servers until further notice. The step followed a security researcher's public disclosure of more than 30 alleged zero-day vulnerabilities (flaws made public before a fix exists), including exploits that could let attackers take over vulnerable systems. [1][2]

The Hacker News reports the researcher disclosed 33 flaws with proof-of-concept exploit code, collectively tracked as Able2Shell. N-able described the shutdown of the hosted service as a precaution while it takes the necessary actions to secure the environment. [2]

What the flaws allow

SecurityWeek reports that attackers could exploit the flaws for remote code execution (running their own commands on a server), credential theft and the creation of administrator accounts. [3]

What is not yet known

The coverage reviewed does not give CVE identifiers, a patch timetable, or any sign that the flaws have been exploited in attacks. It also does not say when the hosted service will return. [1][2][3]

Timeline

  1. N-able described the hosted shutdown as a precaution after a researcher disclosed 33 flaws with proof-of-concept exploits. [2]

  2. N-able urged on-premises customers to shut down their N-central servers. [1]

  3. N-able took its hosted N-central environments offline. [1]

Explained

The technology and terms in this story. Learn more

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

If your IT provider manages your computers with N-central, its service may be affected. N-able has taken its hosted service offline. [1][2]

What to do

  1. Ask your IT provider whether it uses N-central and how it is handling the shutdown. [1]
  2. Watch for N-able's updates on when the service returns. [2]

Mid-size company

A small IT or security team

What to know

N-able has urged customers running N-central on their own servers to shut them down until further notice. No fix has been described in the coverage reviewed. [1][2]

What to do

  1. Shut down on-premises N-central servers as N-able has urged. [1][2]
  2. Follow N-able's advisories for further instructions. [2]

Large enterprise

A security operations team

What to know

Public proof-of-concept exploits were released with the disclosure, and the flaws are reported to allow code execution and administrator account creation. [2][3]

What to do

  1. Take on-premises N-central servers offline as N-able urges. [1]
  2. Identify managed service providers that use N-central and ask how they are responding. [1][2]
  3. Review N-central administrator accounts for unexpected additions, given the account-creation flaws reported. [3]

Sources

  1. [1]BleepingComputer · Nov 9, 21:26 UTC
    N-able takes cloud platform offline after 30+ "zero-days" publishedcontext
  2. [2]The Hacker News · Nov 10, 06:44 UTC
    N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploitscontext
  3. [3]SecurityWeek · Nov 10, 09:56 UTC
    N-able Takes N-central Offline as Researcher Drops Over 30 Zero-Dayscontext