N-able on Monday took hosted N-central environments offline in response to a security researcher’s public disclosure of more than 30 alleged zero-day vulnerabilities.
“As a precautionary measure, we are temporarily taking our Hosted N-central environment offline while we take the necessary actions to secure the environment and implement appropriate remediation,” the company said.
While N-central and the related services remain inaccessible, N-able says it has made progress validating the flaws and creating a fix, which should roll out around midday on November 10.
On-premises N-central deployments should also be kept offline until patches are released, the company says.
“N-able Engineering continues to make progress on the N-central hotfix and associated validation activities. The work remains on track with no setbacks, and our teams are progressing as quickly as possible while maintaining the validation required for a safe remediation,” the company said.
N-able also pointed out that it has no evidence that the vulnerabilities have been exploited against its N-central environments.
The zero-day bugs were published on GitHub on Sunday by security researcher Sean Bales and have yet to be assigned CVE identifiers. Bales dubbed the flaws Able2Shell.
According to the researcher, the weaknesses could be exploited to achieve remote code execution (RCE) with ‘nable’ or root privileges, to execute arbitrary commands, create unauthorized administrative accounts, or leak sensitive data, such as configurations and credentials.
Additionally, Bales describes four exploit chains that could also lead to RCE with ‘nable’ or root privileges.
The security researcher released proof-of-concept (PoC) code targeting every flaw and reportedly explained that the zero-days were dropped after N-able failed to patch security defects he previously reported in another product.
Related: Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH
Related: Cisco, WatchGuard Release Patches; SonicWall Won’t Fix GMS Flaws
Related: Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day
Related: Barracuda ESG Authentication Bypass Flaw Opens Path to Root
