CVE-2025-11700
HIGH EXPLOITED NUCLEIN-able N-Central Authentication Bypass and XXE Scanner
Title source: metasploitExploitation Summary
CVE-2025-11700 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 3 public exploits from researchers including horizon3ai, zyyyys123, Zach Hanley (Horizon3.ai), including a Metasploit module auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.
A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional Python exploit for chaining CVE-2025-9316 and CVE-2025-11700 to perform an unauthenticated XXE attack on N-able N-central, allowing sensitive file reads. The exploit includes a DTD server and multi-step SOAP request handling to extract credentials.
Description
N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure
Exploits (3)
This repository contains a functional Python exploit for chaining CVE-2025-9316 and CVE-2025-11700 to perform an unauthenticated XXE attack on N-able N-central, allowing sensitive file reads. The exploit includes a DTD server and multi-step SOAP request handling to extract credentials.
This repository contains a functional Go-based exploit for CVE-2025-11700, an XXE vulnerability in N-able N-central. The exploit demonstrates a multi-step attack to extract a session ID, upload an XXE payload, and trigger the vulnerability to read arbitrary files.
This Metasploit module exploits CVE-2025-9316 (authentication bypass) and CVE-2025-11700 (XXE) in N-able N-Central. It first bypasses authentication via SOAP requests with appliance IDs, then leverages XXE to read arbitrary files.
Nuclei Templates (1)
http.title:"N-central Login"
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N