N-able Pulls Cloud Remote Access Service Offline After Researcher Publishes Zero-Day Bugs

Remote access company N-able has taken its cloud-hosted service offline to address a batch of security vulnerabilities published online this week without prior notice to the company.

In a status update, N-able said its hosted N-Central offering is down "while we take the necessary actions to secure the environments and implement appropriate remediation." The company also urged customers to shut down their own self-hosted N-Central deployments, warning that attackers could exploit the publicly disclosed flaws to break into customer networks.

During the outage, customers cannot use N-Central, which lets businesses remotely access and manage other devices and systems on the same network. Remote access tools are a frequent target for hackers because they can open wide access to a company's network and internal data.

Security researcher Ben Bales released the zero-day bugs on GitHub on Sunday, calling them Able2Shell in a post on X. He described them as a mix of vulnerabilities that can steal credentials, create new administrative accounts and gain root access to affected N-able systems. Bales told Bleeping Computer he published the bugs because the company allegedly failed to patch flaws reported in a different product.

N-able said it has no evidence of successful exploitation against any customer environments. A company spokesperson did not respond to a request for comment on whether N-able has the ability to check, such as through server logs, or no way to check at all.

Source: TechCrunch