CVE-2021-47960
Information Disclosure via Local HTTP Server in Synology SSL VPN Client
Publication date: 2026-04-10
Last updated on: 2026-04-10
Assigner: Synology Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| synology | ssl_vpn_client | 1.4.5-0684 |
| synology | ssl_vpn_client | to 1.4.5-0684 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-552 | The product makes files or directories accessible to unauthorized actors, even though they should not be. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2021-47960 is a vulnerability in the Synology SSL VPN Client versions before 1.4.5-0684 that allows remote attackers to access files within the installation directory.
This is possible because the client runs a local HTTP server bound to the loopback interface, which can be exploited by an attacker who tricks the user into interacting with a crafted web page.
By doing so, the attacker can retrieve sensitive files such as configuration files, certificates, and logs, leading to information disclosure.
How can this vulnerability impact me? :
This vulnerability can lead to the disclosure of sensitive information stored within the Synology SSL VPN Client installation directory.
- Attackers may gain access to configuration files, certificates, and logs.
- Such information disclosure could compromise the security of the VPN connection and potentially expose private data.
Exploitation requires user interaction, specifically visiting a crafted web page.
What immediate steps should I take to mitigate this vulnerability?
The only mitigation provided for this vulnerability is to upgrade the Synology SSL VPN Client to version 1.4.5-0684 or later.
No other mitigations or workarounds are mentioned.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Synology SSL VPN Client allows remote attackers to access sensitive files such as configuration files, certificates, and logs, leading to information disclosure.
Such unauthorized disclosure of sensitive information could potentially impact compliance with data protection standards and regulations like GDPR and HIPAA, which require safeguarding sensitive data against unauthorized access.
However, the provided information does not explicitly state the direct impact on compliance with these standards or any regulatory consequences.