CVE-2021-47961
Plaintext Password Storage in Synology SSL VPN Client Enables Unauthorized Access
Publication date: 2026-04-10
Last updated on: 2026-04-10
Assigner: Synology Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| synology | ssl_vpn_client | to 1.4.5-0684 (exc) |
| synology | ssl_vpn_client | 1.4.5-0684 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-256 | The product stores a password in plaintext within resources such as memory or files. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access to your VPN configuration by remote attackers.
It may also result in interception of your VPN traffic, compromising the confidentiality and integrity of your communications.
Can you explain this vulnerability to me?
This vulnerability involves the Synology SSL VPN Client versions before 1.4.5-0684 storing passwords in plaintext. Because of this insecure storage, remote attackers can access or influence the user's PIN code.
Exploiting this vulnerability may allow attackers to gain unauthorized access to VPN configurations and potentially intercept VPN traffic if the user interacts with the attacker.