CVE-2025-8876

Published Aug 14, 2025

Last updated 5 days ago

N-central

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-8876 is a command injection vulnerability found in N-able N-central versions before 2025.3.1. It stems from improper input validation, which allows for the injection of operating system commands. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary operating system commands on the affected system. This could lead to unauthorized access, data theft, system manipulation, and potential lateral movement within the network. It has been added to the CISA Known Exploited Vulnerabilities list and is actively being exploited in the wild.

Description: Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.
Source: a5532a13-c4dd-4202-bef1-e0b8f2f8d12b
NVD status: Analyzed
Products: n-central

Risk scores

CVSS 4.0

Type: Secondary
Base score: 9.4
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: CRITICAL

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: N-able N-Central Command Injection Vulnerability
Exploit added on: Aug 13, 2025
Exploit action due: Aug 20, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

a5532a13-c4dd-4202-bef1-e0b8f2f8d12b: CWE-20
nvd@nist.gov: CWE-78

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:n-able:n-central:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BBFDA053-AF76-4028-8595-41B18D37717B",
            "versionEndExcluding": "2025.3.1"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.