N-able took its cloud-hosted N-Central service offline this week after security researcher Ben Bales published dozens of zero-day vulnerabilities on GitHub without advance notice to the company. Bales, who released the bugs on Sunday under the name Able2Shell, told Bleaching Computer he disclosed them publicly because N-able allegedly failed to patch flaws he reported in a different product.
The vulnerabilities enable attackers to steal credentials, create new administrative accounts, and gain root access to affected systems. N-Central allows corporate customers to remotely access and manage devices and systems on the same network.
N-able urged customers to take down their own self-hosted N-Central deployments while the company secures its environments and implements remediation. The company said it has no evidence of successful exploitation against any customer environments but did not respond to requests about its ability to detect attacks through server logs or other monitoring methods.