GitHub Exploit Metadata - Exploit Intel

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-12

Technical assessment

Two Nuclei templates that detect vulnerable versions of N-able N-central by extracting a version string from the /login page and comparing it against a known-vulnerable threshold. No exploitation code is present.

Backdoor review

No backdoor observed in reviewed code

The repository contains two Nuclei templates for version detection of N-able N-central and a README with usage instructions. The templates perform a GET request to /login, extract a version string, and compare it to a vulnerable threshold. No backdoor, obfuscated payload, or concealed operator-directed harm is present in the reviewed text.

ClassificationScanner

Model confidence98%

AuthenticationNot required

LanguagesYAML

Target softwareN-able N-central

Attack typesversion detection

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The templates only perform version detection via HTTP GET and string comparison; they do not send any payload, deserialize data, or execute commands. The README explicitly describes them as a 'Version detection template'.

README.md:5CVE-2025-8875.yaml:16-40

Requirements

Target must expose an N-central login page at /login that returns HTTP 200 and contains a version string matching the regex 202\d+\.\d+\.\d+\.\d+\b.CVE-2025-8875.yaml:17-26

Observed behavior

Sends an HTTP GET request to {{BaseURL}}/login.CVE-2025-8875.yaml:17-19
Extracts a version string from the response body using the regex 202\d+\.\d+\.\d+\.\d+\b.CVE-2025-8875.yaml:22-26
Matches if the response status is 200, the body contains class="ncentral", and the extracted version is less than 2025.3.1.9.CVE-2025-8875.yaml:28-40

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Nuclei Template: CVE-2025-8875.yamlNuclei template for detecting vulnerable N-central versions via GET /login and version comparison.CVE-2025-8875.yaml:1-40
Nuclei Template: CVE-2025-8876.yamlNuclei template for detecting vulnerable N-central versions via GET /login and version comparison.CVE-2025-8876.yaml:1-40
Contact Info: Signal link in README.mdAuthor provides a Signal contact link for questions; no malicious behavior is indicated.README.md:27

Review boundaries

What the analysis did not establish

One file (metadata only) was omitted from the evidence; its content is unknown.
The evidence does not include any exploit payload or proof of exploitation.
One file (metadata only, flagged as non-text) was not included in the text evidence; its content is unknown.
Binary files were not analyzed; the analysis scope covers only the provided readable text.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

rxerium/CVE-2025-8875-CVE-2025-8876