HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2021-47961

CVSS 8.1v3.1pub. 2026-04-10upd. 2026-05-29

A plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access or influence the user's PIN code due to insecure storage. This may lead to unauthorized VPN configuration and potential interception of subsequent VPN traffic when combined with user interaction.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Synology Ssl Vpn Client
APP
Synology
< 1.4.5-0684

🟢

PATCH AVAILABLE

Vendor update available. Deploy in standard maintenance cycle.

Tags

VPN

CWE

References

www.synology.com/en-global/security/advisory/Synology_S…

Related vulnerabilities

CVE-2018-13283HIGH8.8same product

Lack of administrator control over security vulnerability in client.cgi in Synology SSL VPN Client before 1.2....

CVE-2018-8929HIGH7.3same product

Improper restriction of communication channel to intended endpoints vulnerability in HTTP daemon in Synology S...

CVE-2021-47960MEDIUM6.5same product

Podatność dostępu do plików lub katalogów przez strony trzecie w Synology SSL VPN Client przed wersją 1.4.5-06...

CVE-2023-5748LOW3.3same product

Podatność bufferFlow overflow (kopiowanie buffera bez sprawdzenia rozmiaru wejścia) w komponencie CGI Synology...

CVE-2025-12686CRITICAL9.8PL ✓same vendor

Classic Buffer Overflow w Synology BeeStation OS — zdalne wykonanie kodu