N-Able take the N-Central RMM (Remote Management and Monitoring) tool down worldwide, all day, while they work on this. Status: https://uptime.n-able.com/event/202561/
The researcher claims they notified the company 90 days ago in more than one email, and the company did not respond. The company status page says this disclosure is "non-responsible" and they were not notified. For history, N-Able separated from SolarWinds after the "solarwinds123" password leak around 2019; analysts at Omdia put them at the 4th largest RMM vendor with 8.4% of the market, after Kaseya, ConnectWise and NinjaOne. Not enormous, but they claim 500,000 companies across all of their product range. And earlier this year, this product had three critical vulnerabilities in six weeks, rated CVSS 10.0: https://tech-insider.org/n-able-n-central-third-zero-day-cvs...
They were also actively exploited back in July/August and took ages to properly patch the vulnerabilities. Their poor response during that incident should've already been enough of a reason to get off their product stack.
N-Able take the N-Central RMM (Remote Management and Monitoring) tool down worldwide, all day, while they work on this. Status: https://uptime.n-able.com/event/202561/
Github repo with 33x 0-day exploits including multiple RCE (Remote Code Execution) and root: https://github.com/Oracle-Security/CVEs/tree/main/0-Days/N-C...
The researcher claims they notified the company 90 days ago in more than one email, and the company did not respond. The company status page says this disclosure is "non-responsible" and they were not notified. For history, N-Able separated from SolarWinds after the "solarwinds123" password leak around 2019; analysts at Omdia put them at the 4th largest RMM vendor with 8.4% of the market, after Kaseya, ConnectWise and NinjaOne. Not enormous, but they claim 500,000 companies across all of their product range. And earlier this year, this product had three critical vulnerabilities in six weeks, rated CVSS 10.0: https://tech-insider.org/n-able-n-central-third-zero-day-cvs...
They were also actively exploited back in July/August and took ages to properly patch the vulnerabilities. Their poor response during that incident should've already been enough of a reason to get off their product stack.