PT-2018-18727 · Synology · Synology Ssl Vpn Client

Yu-Chi Ding · Published 2018-07-06 · Updated 2021-05-12 · CVE-2018-8929

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Synology SSL VPN Client versions prior to 1.2.4-0224

Description The issue is related to an improper restriction of communication channels, allowing remote attackers to conduct man-in-the-middle attacks via a crafted payload. This affects the HTTP daemon in the Synology SSL VPN Client.

Recommendations For versions prior to 1.2.4-0224, update to version 1.2.4-0224 or later to resolve the issue. As a temporary workaround, consider restricting access to the HTTP daemon to minimize the risk of exploitation.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

CWE-417

Related Identifiers

CVE-2018-8929

Affected Products

Synology Ssl Vpn Client

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-8929 · Security Note
• https://osv.dev/vulnerability/CVE-2018-8929 · Vendor Advisory
• https://synology.com/en-global/support/security/Synology_SA_18_19 · Vendor Advisory