CVE-2021-47961 json
A plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access or influence…
published 6mo ago modified 4mo ago also EUVD-2021-34779
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 26%
- public exploits
- 0
- none known
Summary
A plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access or influence the user's PIN code due to insecure storage. This may lead to unauthorized VPN configuration and potential interception of subsequent VPN traffic when combined with user interaction.
Patch / fix
- Synology Synology SSL VPN Client 1.4.5-0684
Is CVE-2021-47961 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 6mo ago
Exploit prediction
0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
Affected products
- Synology Synology SSL VPN Client
Classification
- Weakness
-
- CWE-256 Plaintext Storage of a Password
References
-
synology.com
/en-global/security/advisory/Synology_SA_26_05
vendor-advisory
Sources
- CVE List CVE-2021-47961
- NVD CVE-2021-47961
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.