PatchSiren

PatchSiren cyber security CVE debrief

CVE-2021-47961 Synology CVE debrief

A plaintext storage vulnerability in Synology SSL VPN Client before version 1.4.5-0684 allows remote attackers to access or influence a user's PIN code due to insecure storage. The vulnerability, published on 2026-04-10 and last modified on 2026-05-29, carries a CVSS 3.1 score of 8.1 (HIGH severity) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. The attack requires network access, low attack complexity, no privileges, but does require user interaction. Successful exploitation may lead to unauthorized VPN configuration and potential interception of subsequent VPN traffic when combined with user interaction. The root cause is categorized under CWE-256 (Plaintext Storage of a Password). Synology has addressed this issue in SSL VPN Client version 1.4.5-0684.

Vendor
Synology
Product
Synology SSL VPN Client
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-10
Original CVE updated
2026-05-29
Advisory published
2026-04-10
Advisory updated
2026-05-29

Who should care

Organizations deploying Synology SSL VPN Client for remote access should prioritize patching. Security teams managing endpoint VPN configurations and incident responders investigating potential unauthorized VPN access should review this vulnerability.

Technical summary

The Synology SSL VPN Client prior to 1.4.5-0684 stores the user's PIN code in plaintext, enabling remote attackers with network access to retrieve or influence this credential. With user interaction, an attacker can leverage this access to modify VPN configurations and potentially intercept subsequent VPN traffic. The confidentiality and integrity impacts are rated HIGH, with no availability impact. The vulnerability is remotely exploitable with low complexity but requires user interaction, preventing fully automated exploitation.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Synology SSL VPN Client to version 1.4.5-0684 or later to remediate the plaintext PIN storage vulnerability.
  • Review VPN client configurations for unauthorized changes that may indicate prior exploitation.
  • Audit endpoint storage locations where the SSL VPN Client may cache or store credentials to ensure no residual plaintext PIN data remains after patching.
  • Educate users about phishing and social engineering risks, as successful exploitation requires user interaction.
  • Monitor VPN connection logs for anomalous configuration changes or unexpected traffic patterns.

Evidence notes

The affected product is Synology SSL VPN Client with versions prior to 1.4.5-0684 being vulnerable, as confirmed by NVD CPE criteria and Synology's vendor advisory.

Sources and references

Verified primary and authoritative sources

  • CVE-2021-47961 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2021-47961

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2021-47961 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2021-47961

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.