HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2021-47961

CVSS 8.1v3.1pub. 2026-04-10upd. 2026-05-29

A plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access or influence the user's PIN code due to insecure storage. This may lead to unauthorized VPN configuration and potential interception of subsequent VPN traffic when combined with user interaction.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

  • Synology Ssl Vpn Client

    APP
    Synology
    < 1.4.5-0684
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
VPN
CWE
References

Related vulnerabilities

CVE-2018-13283HIGH8.8ten sam produkt

Lack of administrator control over security vulnerability in client.cgi in Synology SSL VPN Client before 1.2....

CVE-2018-8929HIGH7.3ten sam produkt

Improper restriction of communication channel to intended endpoints vulnerability in HTTP daemon in Synology S...

CVE-2021-47960MEDIUM6.5ten sam produkt

A files or directories accessible to external parties vulnerability in Synology SSL VPN Client before 1.4.5-06...

CVE-2023-5748LOW3.3ten sam produkt

Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synol...

CVE-2025-12686CRITICAL9.8PL ✓ten sam vendor

Classic Buffer Overflow w Synology BeeStation OS — zdalne wykonanie kodu