N-able N-central Multiple Zero-Day Vulnerabilities Disclosure

Security researchers have publicly disclosed more than 30 alleged zero-day vulnerabilities affecting N-able N-central, a widely used Remote Monitoring and Management (RMM) platform.

Following the disclosure, N-able took its hosted N-central environments offline worldwide and advised customers operating on-premises deployments to shut down their servers as a precautionary measure.

The vulnerabilities were published by security researcher Sean Bales, along with proof-of-concept (PoC) exploit code, under the project name Able2Shell. The issues include authentication bypass, credential disclosure, arbitrary file write, directory traversal, cross-site scripting (XSS), XML External Entity (XXE) injection, privilege escalation, and Remote Code Execution (RCE).

Of particular concern is an unauthenticated XXE vulnerability that can reportedly be chained with other weaknesses to steal trusted sessions, reset account passwords, create administrative accounts, and execute commands on affected N-central servers. Researchers also reported exploit chains capable of achieving root-level code execution. A compromised N-central server could also allow attackers to execute commands, deploy malicious scripts, or gain unauthorised access to endpoints and customer environments managed through the RMM platform.

At the time of writing, N-able has stated that it has not observed evidence of active exploitation in customer environments and is actively developing and testing hotfixes to address the disclosed vulnerabilities. However, the exploit code remains publicly available.

For organisations utilising N-able N-central, the following immediate actions are recommended for customers:

• Identify all hosted and on-premises N-central deployments within the environment.
• Follow N-able's shutdown recommendations for on-premises N-central servers and keep them offline until N-able confirms they can safely be brought back online.
• Follow N-able's latest guidance in the official incident advisory (see References) regarding hotfix availability, remediation instructions, and safe service restoration.
• Review authentication logs for the creation of unexpected administrator accounts and server logs for indications of XXE exploitation, arbitrary file-write activity, or privilege escalation.
• Investigate evidence of suspicious command execution originating from N-central servers, and review suspicious remote management activities and unexpected script deployments affecting managed endpoints and customer environments.
• Monitor outbound network communications from N-central infrastructure for anomalous activity.

Potential Indicators of Suspicious Activity and Threat Hunting Opportunities

Customers are advised to review the following suspicious behaviours within their N-central environment and supporting infrastructure. These are threat hunting opportunities, not confirmed indicators of compromise:

• Unexpected creation or re-enablement of administrator accounts.
• Password resets not associated with authorised administrative activity
• Execution of operating system commands under the nable service account.
• Privilege escalation activity resulting in root-level command execution.
• Unusual XML-based requests targeting N-central service-import functionality.
• Unauthorized configuration changes within the N-central management interface.

If your organisation was exposed to these disclosed N-able N-central vulnerabilities, contact the Integrity360 Incident Response team for assistance.