{"id":"CVE-2025-11700","published":"2025-11-12T15:30:38Z","modified":"2025-12-15T14:22:02Z","title":"N-central Multiple XXE Injection Vulnerabilities","vendor":"N-able","product":"N-central","tier":"core","eol":null,"affectedVersions":[{"vendor":"N-able","product":"N-central","versions":["< 2025.4"]}],"description":{"text":"N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure","provenance":"source","from":"CVE.org"},"summary":{"text":"N-able's N-central contains multiple XML External Entity (XXE) injection flaws in its XML processing, which affects versions earlier than 2025.4. An authenticated attacker with network access and low privileges can exploit these flaws without user interaction to read sensitive information from the system.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:44:28Z"},"cvss":{"score":8.4,"severity":"HIGH","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.31682,"percentile":0.98291,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-12-15","exploitedFirstSeen":"2025-12-15","ransomware":false,"evidence":[{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-11700","date":"2025-12-15"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-611","name":"Improper Restriction of XML External Entity Reference"}],"references":[{"url":"https://me.n-able.com/s/security-advisory/aArVy0000000rabKAA","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-131914","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-131914","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"N-able N-Central Authentication Bypass and XXE Scanner","module":"auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe","type":"auxiliary","disclosureDate":"2025-11-17","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb"}],"nuclei":[{"id":"CVE-2025-11700","name":"N-central - XML External Entities Injection","severity":"high","path":"http/cves/2025/CVE-2025-11700.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-11700.yaml"}],"first":{"date":"2025-11-17","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-11-12","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-11700","provenance":"source"},{"date":"2025-11-17","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb","provenance":"source"},{"date":"2025-12-15","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-11700","provenance":"source"}],"speed":{"daysToPublicExploit":5,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":70.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 319 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.66,"detail":"percentile 0.9829"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.88,"detail":"base score 8.4"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}