Vulnerability · Published Oct 29, 2020 · Assigned by synology
CVE-2020-27648
High 8.3
In plain English
A high-severity improper certificate validation in DiskStation Manager (DSM) from Synology. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Severity (CVSS 3.1)8.3High
Exploit odds (30 days)0.7%top 45.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Improper certificate validation vulnerability in OpenVPN client in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Synology | DiskStation Manager (DSM) | unspecified – before 6.2.3-25426-2 |
Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- https://www.synology.com/security/advisory/Synology_SA_20_18 x_refsource_CONFIRM
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1058 x_refsource_MISC