N-able shuts hosted N-Central service as researcher-released flaws circulate online

The short version

• N-able confirmed it took its cloud-hosted N-Central offline to fix vulnerabilities published online this week, and the service remains offline.[TechCrunch]
• N-able urged customers to take down self-hosted N-Central deployments, fearing attackers could use the publicly disclosed exploits.[TechCrunch]
• Researcher Ben Bales released the bugs on GitHub, calling them Able2Shell and describing possible credential theft and root access.[TechCrunch]
• N-able says it has no evidence of successful exploitation, while Bales told Bleeping Computer the company allegedly failed to patch his earlier reports.[TechCrunch]

Key facts

• N-able confirmed it took its cloud-hosted N-Central offering offline to fix security vulnerabilities published online.[TechCrunch]
• N-able said it received no advance notice of the vulnerabilities before they were published.[TechCrunch]
• N-able urged customers to take down self-hosted N-Central deployments, citing fears that attackers could use the publicly disclosed exploits.[TechCrunch]
• Security researcher Ben Bales released the zero-day bugs on GitHub on Sunday.[TechCrunch]
• Bales described the bugs, which he called Able2Shell, as capable of stealing credentials, creating new administrative accounts, and gaining root access.[TechCrunch]
• Bales told Bleeping Computer he released the bugs because the company allegedly failed to patch flaws he reported in a different product.[TechCrunch]
• N-able said it has no evidence of successful exploitation against any of its customer environments.[TechCrunch]

Sources

Outlet counts describe coverage, not independent confirmation. Reports may share a wire service or original source.

• N-able takes its remote access service offline after researcher publishes dozens of zero-day bugsTechCrunch