CVE-2025-7051 - Vulnerability Details - OpenCVE

On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server. This vulnerability is present in all deployments of N-central prior to 2025.2.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
N-able	N-central

No data.

No data.

References

Link	Providers
https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2025.2_Release_Notes.htm

History

Sat, 23 Aug 2025 11:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		N-able N-able n-central
Vendors & Products		N-able N-able n-central

Thu, 21 Aug 2025 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 21 Aug 2025 17:45:00 +0000

Type	Values Removed	Values Added
Description		On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server. This vulnerability is present in all deployments of N-central prior to 2025.2.
Title		N-central Syslog Configuration Insecure Direct Object Reference
Weaknesses		CWE-284
References		https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2025.2_Release_Notes.htm
Metrics		cvssV3_1 `{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L'}`

MITRE

Status: PUBLISHED

Assigner: N-able

Published: 2025-08-21T17:34:31.126Z

Updated: 2025-08-22T03:55:44.928Z

Reserved: 2025-07-03T18:14:43.132Z

Link: CVE-2025-7051

Vulnrichment

Updated: 2025-08-21T20:02:49.389Z

NVD

Status : Awaiting Analysis

Published: 2025-08-21T18:15:37.143

Modified: 2025-08-22T18:08:51.663

Link: CVE-2025-7051

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-7051", "assignerOrgId": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b", "state": "PUBLISHED", "assignerShortName": "N-able", "dateReserved": "2025-07-03T18:14:43.132Z", "datePublished": "2025-08-21T17:34:31.126Z", "dateUpdated": "2025-08-22T03:55:44.928Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "N-central", "vendor": "N-able", "versions": [{"lessThanOrEqual": "2024.6.16", "status": "affected", "version": "2024.6.0", "versionType": "custom"}, {"status": "affected", "version": "2025.1", "versionType": "custom"}]}], "datePublic": "2025-08-21T17:16:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server. This vulnerability is present in all deployments of N-central prior to 2025.2."}], "value": "On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server. This vulnerability is present in all deployments of N-central prior to 2025.2."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b", "shortName": "N-able", "dateUpdated": "2025-08-21T17:34:31.126Z"}, "references": [{"url": "https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2025.2_Release_Notes.htm"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Upgrade to N-central version 2025.2 or higher."}], "value": "Upgrade to N-central version 2025.2 or higher."}], "source": {"discovery": "UNKNOWN"}, "title": "N-central Syslog Configuration Insecure Direct Object Reference", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-21T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2025-7051"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-22T03:55:44.928Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-7051", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-21T20:02:41.223244Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-21T20:02:49.389Z"}}], "cna": {"title": "N-central Syslog Configuration Insecure Direct Object Reference", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "N-able", "product": "N-central", "versions": [{"status": "affected", "version": "2024.6.0", "versionType": "custom", "lessThanOrEqual": "2024.6.16"}, {"status": "affected", "version": "2025.1", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to N-central version 2025.2 or higher.", "supportingMedia": [{"type": "text/html", "value": "Upgrade to N-central version 2025.2 or higher.", "base64": false}]}], "datePublic": "2025-08-21T17:16:00.000Z", "references": [{"url": "https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2025.2_Release_Notes.htm"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server. This vulnerability is present in all deployments of N-central prior to 2025.2.", "supportingMedia": [{"type": "text/html", "value": "On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server. This vulnerability is present in all deployments of N-central prior to 2025.2.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284"}]}], "providerMetadata": {"orgId": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b", "shortName": "N-able", "dateUpdated": "2025-08-21T17:34:31.126Z"}}}, "cveMetadata": {"cveId": "CVE-2025-7051", "state": "PUBLISHED", "dateUpdated": "2025-08-22T03:55:44.928Z", "dateReserved": "2025-07-03T18:14:43.132Z", "assignerOrgId": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b", "datePublished": "2025-08-21T17:34:31.126Z", "assignerShortName": "N-able"}, "dataVersion": "5.1"}