PT-2019-8948 · Synology · Synology Ssl Vpn Client

Yu-Chi Ding · Published 2019-04-01 · Updated 2019-10-09 · CVE-2018-13283

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Synology SSL VPN Client versions prior to 1.2.5-0226

Description The issue is related to a lack of administrator control over security vulnerabilities in the client.cgi component. This allows remote attackers to conduct man-in-the-middle attacks by manipulating the command, hostname, or port parameters.

Recommendations For versions prior to 1.2.5-0226, update to version 1.2.5-0226 or later to resolve the issue. As a temporary workaround, consider restricting access to the client.cgi component to minimize the risk of exploitation. Avoid using the command, hostname, or port parameters in the affected API endpoint until the issue is resolved.

Fix

Weakness Enumeration

CWE-671

Related Identifiers

CVE-2018-13283

Affected Products

Synology Ssl Vpn Client

References · 3

• https://synology.com/security/advisory/Synology_SA_18_30 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-13283 · Security Note
• https://osv.dev/vulnerability/CVE-2018-13283 · Vendor Advisory