Executive Summary

CVE-2021-47960 is a vulnerability in the Synology SSL VPN Client versions before 1.4.5-0684 that allows remote attackers to access files within the installation directory.

This is possible because the client runs a local HTTP server bound to the loopback interface, which can be exploited by an attacker who tricks the user into interacting with a crafted web page.

By doing so, the attacker can retrieve sensitive files such as configuration files, certificates, and logs, leading to information disclosure.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the disclosure of sensitive information stored within the Synology SSL VPN Client installation directory.

• Attackers may gain access to configuration files, certificates, and logs.
• Such information disclosure could compromise the security of the VPN connection and potentially expose private data.

Exploitation requires user interaction, specifically visiting a crafted web page.

Useful 0 Not Useful 0

Mitigation Strategies

The only mitigation provided for this vulnerability is to upgrade the Synology SSL VPN Client to version 1.4.5-0684 or later.

No other mitigations or workarounds are mentioned.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Synology SSL VPN Client allows remote attackers to access sensitive files such as configuration files, certificates, and logs, leading to information disclosure.

Such unauthorized disclosure of sensitive information could potentially impact compliance with data protection standards and regulations like GDPR and HIPAA, which require safeguarding sensitive data against unauthorized access.

However, the provided information does not explicitly state the direct impact on compliance with these standards or any regulatory consequences.

Useful 0 Not Useful 0