H3-2025-0057¶
N-able N-central Authentication Bypass Vulnerability
| Category | VULNERABILITY |
| Base Score | 9.0 |
Description¶
This vulnerability was discovered by Horizon3.ai researchers and responsibly disclosed to N-able as a 0-day. H3-2025-0057 (CVE-2025-9316) abuses an authentication bypass vulnerability to allow remote attackers to interact with sensitive APIs on the N-central appliance.
Impact¶
Unauthenticated attackers with access to the N-central SOAP API service can interact with sensitive APIs, listening by default on tcp/80 and tcp/443. Access to these APIs can allow the attacker to conduct further attacks, read and configure background services, and disrupt appliance operations.