N-able Takes N-central Platform Offline After Discovery of 33 Flaws

Remote access provider N-able has taken down its cloud-based service, N-Central, following the publication of multiple critical security flaws. The company issued a notice on its website stating that the service is offline while they work to secure their systems and apply the necessary fixes. Customers were advised to disable their own self-hosted versions of N-Central, given the potential for attackers to exploit the disclosed vulnerabilities to infiltrate networks.

The N-Central platform enables corporate clients to remotely manage devices and systems within their own networks. Remote access solutions are often prime targets for cybercriminals, as they can provide extensive access to a company's internal infrastructure and data. Security researcher Ben Bales disclosed the set of vulnerabilities, dubbed Able2Shell, on GitHub on Sunday.

In an X post, Bales characterized the flaws as a blend of bugs allowing for credential theft, the creation of administrative accounts, and root access on affected N-able systems. Bales stated he made the bugs public due to what he claimed was the company's failure to address the issues reported in another product. N-able claimed no evidence of successful exploitation against any customer environments.

However, a spokesperson declined to comment on the company's capabilities to monitor for such activity or confirm if they lack the means to do so.