N-able Takes Remote Access Service Offline After Researcher Publishes Dozens of Zero-Day Bugs
N-able was forced to take its cloud-hosted remote access service offline after a security researcher publicly disclosed dozens of zero-day vulnerabilities without prior notice.
Remote access company N-able has confirmed it took down its cloud-hosted offering to fix a slew of security vulnerabilities that were published online this week, giving the company no advance notice to fix them.
In a status update on its website, the company said its hosted N-Central offering for customers is now offline “while we take the necessary actions to secure the environments and implement appropriate remediation.” The company also urged customers to take down their own self-hosted deployments of N-Central, fearing that attackers could use the publicly disclosed exploits to hack into customer networks.
During this time, customers will not be able to use their N-Central service, which allows corporate customers to remotely access and manage other devices and systems on the same network. Remote access technologies are a frequent target of hackers, as these systems can grant vast access to a company’s network and internal data.
Security researcher Ben Bales released the “zero-day” bugs on GitHub on Sunday. In a post on X, Bales dubbed the bugs Able2Shell, describing them as a mix of vulnerabilities capable of stealing credentials, creating new administrative accounts, and gaining root access to affected N-able systems.
Bales told Bleeping Computer that he publicly released the bugs as the company allegedly failed to patch the flaws reported in a different product. N-able said that it has no evidence of successful exploitation against any of its customer environments.