H3-2025-0057
N-able N-central Authentication Bypass Vulnerability
| Category | VULNERABILITY |
| Base Score | 9.0 |
Description
This vulnerability was discovered by Horizon3.ai researchers and responsibly disclosed to N-able as a 0-day. H3-2025-0057 (CVE-2025-9316) abuses an authentication bypass vulnerability to allow remote attackers to interact with sensitive APIs on the N-central appliance.
Impact
Unauthenticated attackers with access to the N-central SOAP API service can interact with sensitive APIs, listening by default on tcp/80 and tcp/443. Access to these APIs can allow the attacker to conduct further attacks, read and configure background services, and disrupt appliance operations.