{"id":"CVE-2024-28200","published":"2024-07-01T20:49:38Z","modified":"2024-08-02T00:48:49Z","title":"N-central Authentication Bypass","vendor":"N-able","product":"N-central","tier":"core","eol":null,"affectedVersions":[{"vendor":"N-able","product":"N-central","versions":["<2024.2"]}],"description":{"text":"The N-central server is vulnerable to an authentication bypass of the user interface. This vulnerability is present in all deployments of N-central prior to 2024.2.\n\nThis vulnerability was discovered through internal N-central source code review and N-able has not observed any exploitation in the wild.","provenance":"source","from":"CVE.org"},"summary":{"text":"The N-central server from N-able has an authentication bypass flaw in its user interface, affecting all deployments prior to 2024.2. An attacker with network access can reach the interface and bypass authentication without credentials or any user interaction, which lets them access functionality they should not be able to reach.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-11-01T01:04:20Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01946,"percentile":0.80181,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-04-11","exploitedFirstSeen":"2024-04-11","ransomware":false,"evidence":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26234","date":"2024-04-11"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-288","name":"Authentication Bypass Using an Alternate Path or Channel"}],"references":[{"url":"https://documentation.n-able.com/N-central/Release_Notes/GA/Content/2024.2%20Release%20Notes.htm","tags":[]},{"url":"https://me.n-able.com/s/security-advisory/aArVy0000000673KAA/cve202428200-ncentral-authentication-bypass","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-25319","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-25319","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2024-28200","name":"N-able N-central < 2024.2 - Authentication Bypass Detection","severity":"critical","path":"http/cves/2024/CVE-2024-28200.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-28200.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-04-11","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26234","provenance":"source"},{"date":"2024-07-01","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-28200","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":62.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 934 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":16.04,"detail":"percentile 0.8018"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-n-able-central-cwe-288"}}