N-able took its hosted N-central environments offline on Monday as a direct response to the public disclosure of more than 30 alleged zero-day vulnerabilities by security researcher Sean Bales.
“As a precautionary measure, we are temporarily taking our Hosted N-central environment offline while we take the necessary actions to secure the environment and implement appropriate remediation,” the company said in a statement.
While the hosted service remains inaccessible, N-able reported steady progress in validating the flaws and developing fixes. The company expects to release a hotfix around midday on November 10. On-premises N-central deployments are also advised to stay offline until patches are applied.
N-able emphasized that it has found no evidence the vulnerabilities have been exploited in the wild against its environments. Engineering teams continue validation activities to ensure safe remediation without setbacks.
The flaws were published on GitHub on Sunday under the name Able2Shell and have not yet received CVE identifiers. According to Bales, the weaknesses enable remote code execution with nable or root privileges, execution of arbitrary commands, creation of unauthorized administrative accounts, and leakage of sensitive data such as configurations and credentials.
Bales additionally described four exploit chains that could lead to the same level of access. He released proof-of-concept code for every vulnerability. The researcher stated the disclosure occurred after N-able failed to address security defects he had previously reported in another product.
