Hackers Target N-central Zero-Days as N-able Rushes Patches
N-able has rolled out patches for several of the zero-days a researcher dropped over the weekend and warned of in-the-wild activity targeting them.
Security researcher Sean Bales published details and proof-of-concept (PoC) on more than 30 N-central vulnerabilities he calls Able2Shell, saying he did not responsibly disclose them because he was unhappy with N-able not patching two flaws he previously reported in another product.
On Monday, the company took hosted N-central environments offline to investigate the security defects and develop fixes, urging customers to disconnect their on-premises deployments as well.
Although patches have been developed only for the more important bugs, N-able has brought the hosted environments back online, saying the risk is largely mitigated.
According to the company, all the vulnerabilities that could be exploited without authentication have been resolved, with fixes prioritized based on severity and exploitability.
“The remaining vulnerabilities require an authenticated N-central account often with...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
