Act today High Check your exposure
N-able restricts N-central features as new flaws are exploited on servers
The Hacker NewsN-able, N-central
What happened. N-able is restricting some N-central features and integrations while fixes are completed. The report adds a second flaw, Agent2Shell, alongside 4EverAble2Shell. The headline says attackers infected 21 servers, 19 of them running Hotfix 2.
Who is affected. Users of N-able N-central remote-management software. Industrial sites whose IT providers or engineers use it to reach servers and networks are exposed, as it is a common remote-access path.
What to do. Check whether you or your service providers run N-able N-central, read N-able's Thursday update, and apply its remediation steps as they are released. Expect some features to be limited meanwhile.
When to act. Act today: Sites running N-central: check for exposed instances and apply the vendor's restrictions until remediation is complete.
Editor's reading
Forasset ownerOT security leadIT security
- Purdue level
- L4
- L3.5
Why: N-central is remote-management software run from enterprise IT (L4). Vendors and engineers often reach plant systems through it, which places it in the industrial DMZ (L3.5).
- Are you exposed?
Search your asset inventory and your providers' tooling for N-central servers and agents, and note whether they run Hotfix 2.
- If you cannot fix it yet
- Limit which hosts and accounts can reach the N-central server, and keep it off the plant network until remediation is complete.
- Require multi-factor authentication for every N-central administrator and remote-access login.
- Disable N-central integrations you do not need, as N-able itself is doing for certain features.
- Watch for
- Unexpected new processes, scheduled tasks or services on servers managed by N-central, including crypto-mining activity.
- Logons or remote-management sessions from the N-central server to L2 or L3 hosts that are not normally managed that way.
- ATT&CK for ICS
- T0866Exploitation of Remote ServicesT0886Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.