Vulnerability · Published Apr 10, 2026 · Assigned by synology
CVE-2021-47961
High 8.1
In plain English
A high-severity security flaw in Synology SSL VPN Client from Synology. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.3%top 74.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access or influence the user's PIN code due to insecure storage. This may lead to unauthorized VPN configuration and potential interception of subsequent VPN traffic when combined with user interaction.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Synology | Synology SSL VPN Client | * – before 1.4.5-0684 |
Weakness: CWE-256 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
References
- Synology-SA-26:05 Synology SSL VPN Client vendor-advisory