N-able takes its remote access service offline after researcher publishes dozens of zero-day bugs

Summary

• Remote access company N-able took down its cloud-hosted N-Central offering to fix security vulnerabilities published online without advance notice.
• The company urged customers to take down their self-hosted N-Central deployments to prevent attackers from using the disclosed exploits.
• Customers cannot use the N-Central service, which allows remote access & management of devices & systems on the same network, while remediation occurs.
• Security researcher Ben Bales released the zero-day bugs on GitHub on Sunday & dubbed them Able2Shell.
• The Able2Shell vulnerabilities are capable of stealing credentials, creating new administrative accounts, & gaining root access to affected systems.
• Bales publicly released the bugs after alleging the company failed to patch flaws reported in a different product.
• N-able stated it has no evidence of successful exploitation against any customer environments.