N-able

The article highlights critical vulnerabilities in **N-able’s N-central**, an RMM (Remote Monitoring and Management) tool used by MSPs (Managed Service Providers) to oversee thousands of SMB (Small and Midsize Business) environments. Two severe flaws—**CVE-2025-8876 (command injection via unsanitized user input)** and **CVE-2025-8875 (insecure deserialization leading to arbitrary command execution)**—pose a high risk of exploitation. Over **780 vulnerable N-central servers remain exposed globally**, with concentrations in North America (415) and Europe (239), while Shodan reports over **3,000 exposed instances**. Exploitation could grant attackers **full control over MSP systems**, enabling lateral movement into client networks, data exfiltration, or deployment of ransomware across interconnected SMBs. Given N-central’s role in managing IT infrastructure for thousands of businesses, a successful attack could **disrupt operations, compromise sensitive data, or trigger cascading breaches** across supply chains. The historical context—N-able’s origins as SolarWinds’ MSP division (spun off post-2021)—adds weight to the risk, as threat actors may leverage familiarity with legacy systems for targeted campaigns. The exposure of **unpatched, internet-facing servers** amplifies the likelihood of mass exploitation, potentially leading to **widespread outages, financial fraud, or operational paralysis** for dependent organizations.

Source: https://www.csoonline.com/article/4043926/critical-n-central-rmm-flaws-actively-exploited-in-the-wild.html

TPRM report: https://www.rankiteo.com/company/solarwindsmsp

"id": "sol816082325",
"linkid": "solarwindsmsp",
"type": "Vulnerability",
"date": "6/2021",
"severity": "100",
"impact": "",
"explanation": "Attack threatening the organization’s existence"

{'affected_entities': [{'customers_affected': 'Thousands of MSPs and SMBs '
                                              'using N-central',
                        'industry': 'Technology (IT Management)',
                        'location': 'Global (HQ in USA)',
                        'name': 'N-able',
                        'type': 'Software Developer (MSP/RMM Solutions)'},
                       {'customers_affected': 'Thousands of SMBs managed via '
                                              'N-central',
                        'industry': 'IT Services',
                        'location': ['North America', 'Europe', 'Global'],
                        'name': 'Managed Service Providers (MSPs) using '
                                'N-central',
                        'type': 'Service Providers'},
                       {'industry': 'Multiple Industries',
                        'location': 'Global',
                        'name': 'Small and Midsize Businesses (SMBs)',
                        'type': 'End Customers'}],
 'attack_vector': ['Command Injection (CVE-2025-8876)',
                   'Insecure Deserialization (CVE-2025-8875)'],
 'description': 'According to statistics from the Shadowserver Foundation, '
                'there are over 780 vulnerable N-central servers exposed to '
                'the internet, with the majority located in North America '
                '(415) and Europe (239). Shodan shows over 3,000 results for '
                'N-central. The product, developed by N-able (a spin-off from '
                'SolarWinds in 2021), is used by MSPs to manage thousands of '
                'small and midsize businesses (SMBs). Two critical '
                'vulnerabilities were identified: a command injection flaw via '
                'improper sanitization of user input (CVE-2025-8876) and an '
                'insecure deserialization vulnerability leading to command '
                'execution (CVE-2025-8875). These vulnerabilities pose a '
                'significant risk as N-central is widely used by MSPs and '
                'Remote Monitoring and Management (RMM) software providers, '
                'making them prime targets for cyberattacks.',
 'impact': {'brand_reputation_impact': 'Potential reputational damage to '
                                       'N-able and affected MSPs if '
                                       'vulnerabilities are exploited',
            'operational_impact': 'High risk to MSPs and thousands of SMBs due '
                                  'to potential exploitation of N-central '
                                  'vulnerabilities',
            'systems_affected': '780+ vulnerable N-central servers (3,000+ '
                                'total exposed per Shodan)'},
 'initial_access_broker': {'high_value_targets': 'MSPs and RMM software (e.g., '
                                                 'N-central)'},
 'investigation_status': 'Ongoing (Vulnerabilities identified; exposure '
                         'tracking active)',
 'post_incident_analysis': {'root_causes': ['Improper input sanitization '
                                            'leading to command injection '
                                            '(CVE-2025-8876).',
                                            'Insecure deserialization enabling '
                                            'command execution '
                                            '(CVE-2025-8875).',
                                            'Widespread exposure of N-central '
                                            'servers to the internet (780+ '
                                            'vulnerable IPs).']},
 'recommendations': ['Patch N-central servers immediately to mitigate '
                     'CVE-2025-8876 and CVE-2025-8875.',
                     'MSPs should audit and secure their RMM tools to prevent '
                     'supply-chain attacks.',
                     'Implement network segmentation to limit exposure of '
                     'N-central servers.',
                     'Monitor for unusual activity on N-central instances, '
                     'especially command execution attempts.'],
 'references': [{'source': 'Shadowserver Foundation'},
                {'source': 'Shodan Internet Device Search Engine'},
                {'source': 'N-able (Product Vendor)'}],
 'response': {'third_party_assistance': ['Shadowserver Foundation '
                                         '(Vulnerability Tracking)',
                                         'UK Government (Collaboration)']},
 'title': 'Vulnerabilities in N-able N-central Servers Expose Thousands of '
          'MSPs and SMBs',
 'type': ['Vulnerability Exposure', 'Potential Exploitation Risk'],
 'vulnerability_exploited': ['CVE-2025-8876 (Command Injection via Improper '
                             'Input Sanitization)',
                             'CVE-2025-8875 (Insecure Deserialization Leading '
                             'to Command Execution)']}