PT-2026-31905 · Synology · Synology Ssl Vpn Client

Laurent Sibilla · Published 2026-04-10 · Updated 2026-04-13 · CVE-2021-47960

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Synology SSL VPN Client versions prior to 1.4.5-0684

Description A flaw exists in Synology SSL VPN Client that allows remote attackers to access files within the installation directory. This is achieved by leveraging a local HTTP server bound to the loopback interface and user interaction with a specially crafted web page. Successful exploitation can lead to the retrieval of sensitive files, including configuration files, certificates, and logs, resulting in information disclosure.

Recommendations Update Synology SSL VPN Client to version 1.4.5-0684 or later.

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

BDU:2026-05281

CVE-2021-47960

Affected Products

Synology Ssl Vpn Client

References · 6

• https://bdu.fstec.ru/vul/2026-05281 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-47960 · Security Note
• https://synology.com/en-global/security/advisory/Synology_SA_26_05 · Vendor Advisory
• https://twitter.com/CVEarity/status/2043231288703008853 · Twitter Post
• https://twitter.com/autumn_good_35/status/2043717125282664943 · Twitter Post
• https://twitter.com/CVEnew/status/2042561706883453000 · Twitter Post