Synology SSL VPN Client Vulnerability Enabled Remote Access to Sensitive Files

Synology has recently released a crucial security update to fix two notable vulnerabilities in its SSL VPN Client utility.

Tracked under the security advisory Synology-SA-26:05, these flaws could allow remote attackers to access sensitive system files and intercept secure network traffic.

The Synology SSL VPN Client is a popular tool used to establish encrypted connections to internal networks, meaning these vulnerabilities could serve as a direct gateway for threat actors to bypass perimeter defenses.

Synology SSL VPN Client Flaw

The first vulnerability, identified as CVE-2021-47960, carries a Common Vulnerability Scoring System (CVSS) severity score of 6.5.

This flaw exists because files and directories within the VPN client’s installation directory are left accessible to external parties.

If an attacker tricks a user into visiting a specially crafted web page, they can exploit a local HTTP server bound to the device’s loopback interface.

This allows the attacker to silently retrieve sensitive system files, including application configurations, security certificates, and connection logs.

The second issue, tracked as CVE-2021-47961, is even more severe with a CVSS score of 8.1. This vulnerability stems from the insecure plaintext storage of user passwords within the application.

Remote attackers can exploit this weakness to access or manipulate a user’s personal identification number (PIN) code.

Like the first flaw, this attack requires the victim to interact with a malicious web page to trigger the exploit. Once compromised, attackers can gain unauthorized control over the VPN configuration and potentially intercept all subsequent VPN network traffic.

Exploit Tactics and Impact

Both vulnerabilities require a degree of user interaction, meaning attackers cannot exploit them entirely on their own without victim involvement.

They rely on social engineering tactics, such as phishing emails or deceptive links, to lure victims to malicious websites.

However, once triggered, the consequences for personal and corporate security are significant. Unauthorized access to VPN configurations and security certificates completely undermines the encrypted tunnel that virtual private networks are designed to provide.

Security researcher Laurent Sibilla was credited with discovering and reporting these critical issues to Synology.

Fortunately, Synology has fully resolved these security issues in its latest software release. There are no temporary mitigation strategies or alternative workarounds available for these specific flaws, making immediate patching the only effective defense.

Users relying on the Synology SSL VPN Client must upgrade their software to version 1.4.5-0684 or newer to remain secure.

System administrators should verify their endpoint environments and ensure all remote workers have downloaded the patched version. Leaving older versions installed poses an unnecessary risk to the entire network infrastructure.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.