N-able N-central Syslog Configuration Vulnerability Allowing Unauthorized Access and Modification

A vulnerability exists in N-able N-central in all versions prior to 2025.2, allowing any authenticated user to read, write, and modify syslog configurations across different customers on the same N-central server. This issue arises from improper access controls, enabling unauthorized changes to syslog settings, which could lead to misconfigured log exports and potential oversight of critical audit events.

Impact

Exploitation of this vulnerability could result in unauthorized access to syslog configurations, allowing for improper log management and potential loss of important audit trails.

Remediation

Users are advised to upgrade to N-able N-central version 2025.2 or later, which addresses this vulnerability. Instructions for upgrading N-central can be found in the N-able N-central Upgrade Guide.