N-able oo hakad gelisay adeegga N-Central ka dib markii cilmi-baare daabacay cillado amni oo badan

Shirkaddu waxay sheegtay in aanay haynin caddayn ku saabsan in cilladaha la ka faa'iiday, halka afhayeenkeeda aanu ka jawaabin su'aal ku saabsan awoodda ay ku baari karto weerarro hore.

Shirkadda N-able waxay xaqiijisay in ay hakad gelisay adeegga N-Central ee ku salaysan daruuraha si ay u hagaajiso cillado amni oo la daabacay toddobaadkan iyada oo aan hore loo wargelin. Shirkaddu waxay kaloo ku baaqday in macaamiishu ay hakad geliyaan adeegyadooda N-Central ee ay isku maamulaan.

Cilladaha Able2Shell oo lagu daabacay GitHub

Cilmi-baare amni oo lagu magacaabo Ben Bales ayaa cilladaha loo yaqaan zero-day ku daabacay GitHub maalinta Axadda. Isaga oo qoraal ku qoray X, Bales wuxuu cilladaha ugu magacaabay Able2Shell, isaga oo ku tilmaamay in ay yihiin isku dhaf cillado awood u leh in ay xadaan aqoonsiyo, abuuraan akoonno maamule oo cusub, iyo in ay helaan gelitaan xidid ah nidaamyada N-able ee la saameeyay.

Bales wuxuu u sheegay Bleeping Computer in uu cilladaha si cad u daabacay sababtoo ah shirkaddu waxay si la sheegay ugu guuldarraystay in ay hagaajiso cillado la soo sheegay oo ku saabsan badeecad kale.

Adeegga oo offline ah iyo baaqa macaamiisha

N-able waxay sheegtay in adeegga N-Central ee martigelinta ah uu hadda offline yahay, iyada oo xustay in ay qaadayso tallaabooyinka lagama maarmaanka ah si loo sugo deegaannada loona hirgeliyo hagaajin ku habboon. Inta lagu jiro xilligan, macaamiishu ma isticmaali karaan adeegga N-Central, kaas oo u oggolaanaya macaamiisha shirkadaha in ay si fog u galaan oo u maamulaan aaladaha iyo nidaamyada kale ee isku shabakadda ah.

Shirkaddu waxay kaloo ku baaqday in macaamiishu ay hakad geliyaan adeegyadooda N-Central ee ay isku maamulaan, iyada oo ka cabsanaysa in weeraryahannu ay isticmaali karaan cilladaha si cad loo daabacay si ay u galaan shabakadaha macaamiisha.

N-able oo sheegtay in aanay haynin caddayn ka faa'iidaysi

N-able waxay sheegtay in aanay haynin wax caddayn ah oo ku saabsan ka faa'iidaysi guul leh oo ka dhacay mid ka mid ah deegaannada macaamiisheeda. Afhayeen u hadlay shirkadda ayaan ka jawaabin codsi loo diray si loo helo faallo ku saabsan in ay awood u leedahay in ay baarto ka faa'iidaysiga, tusaale ahaan iyada oo adeegsanaysa diiwaannada server-ka, ama in aanay hab kale u lahayn baaritaan.

The company also urged customers to take down self-hosted N-Central deployments following the public release of the Able2Shell vulnerabilities.

N-able has confirmed it took its cloud-hosted N-Central offering offline to fix security vulnerabilities that were published online this week without advance notice, and it urged customers to take down their own self-hosted deployments.

Hosted Service Offline for Remediation

In a status update on its website, N-able said its hosted N-Central offering is now offline "while we take the necessary actions to secure the environments and implement appropriate remediation." The company said customers will not be able to use their N-Central service during the outage. N-Central allows corporate customers to remotely access and manage other devices and systems on the same network.

Researcher Releases Able2Shell Bugs on GitHub

Security researcher Ben Bales released the zero-day bugs on GitHub on Sunday. In a post on X, Bales dubbed the bugs Able2Shell, describing them as a mix of vulnerabilities capable of stealing credentials, creating new administrative accounts, and gaining root access to affected N-able systems. Bales told Bleeping Computer that he publicly released the bugs because the company allegedly failed to patch the flaws reported in a different product.

No Evidence of Exploitation, Company Says

N-able said it has no evidence of successful exploitation against any of its customer environments. A spokesperson for the company did not respond to a request for comment about whether it has the ability to check for exploitation, such as through server logs, or if it has no way to check.