{"uuid": "fd5fa95e-8044-47ac-aeef-5cd2a80aaed2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9316", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Zach Hanley (Horizon3.ai)\", \"Valentin Lobstein \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"This module scans for vulnerable N-able N-Central instances affected by\\n          CVE-2025-9316 (Unauthenticated Session Bypass) and CVE-2025-11700 (XXE).\\n\\n          The module attempts to exploit CVE-2025-9316 by sending a sessionHello SOAP\\n          request to the ServerMMS endpoint with various appliance IDs to obtain an\\n          unauthenticated session. If successful, it then tests for CVE-2025-11700\\n          by writing an XXE payload file and triggering it via importServiceTemplateFromFile.\\n\\n          Files of interest that can be read via XXE:\\n          - /opt/nable/var/ncsai/etc/ncbackup.conf\\n          - /var/opt/n-central/tmp/ncbackup/ncbackup.bin (PostgreSQL dump)\\n          - /opt/nable/etc/keystore.bcfks (encrypted keystore)\\n          - /opt/nable/etc/masterPassword (keystore password)\\n\\n          Affected versions: N-Central < 2025.4.0.9\", \"disclosure_date\": \"2025-11-17\", \"fullname\": \"auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe\", \"is_install_path\": true, \"mod_time\": \"2026-04-02 17:30:43 +0000\", \"name\": \"N-able N-Central Authentication Bypass and XXE Scanner\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/http/nable_ncentral_auth_bypass_xxe\", \"references\": [\"CVE-2025-9316\", \"CVE-2025-11700\", \"URL-https://horizon3.ai/attack-research/attack-blogs/n-able-n-central-from-n-days-to-0-days/\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:37.953066Z"}