Technology1 min read

N-able takes its remote access service offline after researcher publishes dozens of zero-day bugs

By · Via TechCrunch · Published by Everything Blog

In short

The emergency response was triggered after security researcher Ben Bales publicly released dozens of vulnerabilities dubbed Able2Shell on GitHub without advance notice. Bales stated he opted for public disclosure because the vendor allegedly neglected previously reported flaws in a different software offering. Although the vendor maintains that no active exploitation has been detected in client environments, the software remains a high-value intrusion target due to its broad administrative access across corporate networks. Furthermore, the company did not clarify if it retains the technical logs necessary to fully verify whether unauthorized access took place.

Key points

  • The public release of the Able2Shell flaws was intended to protest the vendor's alleged f…: The public release of the Able2Shell flaws was intended to protest the vendor's alleged failure to address previously reported product bugs.
  • N-able took its cloud-hosted platform offline to implement fixes while stating it found n…: N-able took its cloud-hosted platform offline to implement fixes while stating it found no evidence of active exploitation.
  • The company did not respond to questions regarding whether it has the server logs needed…: The company did not respond to questions regarding whether it has the server logs needed to confirm if customer breaches occurred.

Sources checked by our analysis pipeline: 1

Remote access company N-able has confirmed it took down its cloud-hosted offering to fix a slew of security vulnerabilities that were published online this week, giving the company no advance notice to fix them.

In a status update on its website, the company said its hosted N-Central offering for customers is now offline “while we take the necessary actions to secure the environments and implement appropriate remediation.” The company also urged customers to take down their own self-hosted deployments of N-Central, fearing that attackers could use the publicly disclosed exploits to hack into customer networks.

N-able said during this time customers will not be able to use their N-Central service, which allows corporate customers to remotely access and manage other devices and systems on the same network. Remote access technologies are a frequent target of hackers, as these systems can grant vast access to a company’s network and internal data.

Security researcher Ben Bales released the “zero-day” bugs on GitHub on Sunday. In a post on X, Bales dubbed the bugs Able2Shell, describing them as a mix of vulnerabilities capable…

Technology