CVE-2025-9316 PoC — N-able N-central 2025.4 安全漏洞

Source

https://github.com/horizon3ai/n-able_n-central_xxe_file_read

Associated Vulnerability

Title:N-able N-central 2025.4 安全漏洞 (CVE-2025-9316)
Description:N-able N-central是加拿大N-able公司的一个 RMM 平台。为成熟的 MSP 和 IT 专业人员提供了大规模管理、自动化和编排功能。 N-able N-central 2025.4之前版本存在安全漏洞，该漏洞源于为未验证用户生成会话ID。

Description

Proof of concept exploit for N-able N-central to chain CVE-2025-9316 and CVE-2025-11700 to read files

Readme

# N-able N-central Unauthenticated XXE Sensitive Information Leak
Proof of concept exploit for N-able N-central to chain CVE-2025-9316 and CVE-2025-11700 to read files which contain credentials

## Blog Post
Deep-dive analysis here:
[https://www.horizon3.ai/attack-research/attack-blogs/n-able-n-central-from-n-days-to-0-days/](https://www.horizon3.ai/attack-research/attack-blogs/n-able-n-central-from-n-days-to-0-days/)

## Usage
```
% python3 ncentral_xxe_file_read.py -h
usage: ncentral_xxe_file_read.py [-h] --url URL --listen-ip LISTEN_IP --listen-port LISTEN_PORT [--file FILE] [--appliance-id APPLIANCE_ID] [--test-only]

N-able N-Central XXE Vulnerability Exploit

options:
  -h, --help            show this help message and exit
  --url URL             N-Central Base URL
  --listen-ip LISTEN_IP
                        IP address for DTD server to bind to
  --listen-port LISTEN_PORT
                        Port for DTD server to bind to
  --file FILE           Target file to read (default: /etc/passwd)
  --appliance-id APPLIANCE_ID
                        Appliance ID to use (default: 3)
  --test-only           Only test endpoint accessibility
```

## Follow the Horizon3.ai Attack Team on Twitter for the latest security research:
*  [Horizon3 Attack Team](https://twitter.com/Horizon3Attack)
*  [James Horseman](https://twitter.com/JamesHorseman2)
*  [Zach Hanley](https://twitter.com/hacks_zach)

## Disclaimer
This software has been created purely for the purposes of academic research and for the development of effective defensive techniques, and is not intended to be used to attack systems except where explicitly authorized. Project maintainers are not responsible or liable for misuse of the software. Use responsibly.

File Snapshot


 [4.0K]  /data/pocs/dd5f2ca1fdfb854a035ec5dbd6d7bb7ea882b86e
├── [ 15K]  ncentral_xxe_file_read.py
└── [1.7K]  README.md

1 directory, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!