CVE-2021-47961

CVSS 8.1 HIGHEPSS 0.3%CWE-256

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.1EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

10 Apr 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

A plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access or influence the user's PIN code due to insecure storage. This may lead to unauthorized VPN configuration and potential interception of subsequent VPN traffic when combined with user interaction.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected products

Synology · Synology SSL VPN Client

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://www.synology.com/en-global/security/advisory/Synology_SA_26_05