CVE-2018-13283

Severity: high (CVSS 7.4 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-04-01 · updated 2026-06-17
Weakness: CWE-671

Description

Lack of administrator control over security vulnerability in client.cgi in Synology SSL VPN Client before 1.2.5-0226 allows remote attackers to conduct man-in-the-middle attacks via the (1) command, (2) hostname, or (3) port parameter.

Affected products

Synology SSL VPN Client: before 1.2.5-0226 — fixed in 1.2.5-0226

How to fix

Upgrade to a fixed version: Synology SSL VPN Client 1.2.5-0226. Check the vendor advisory for mitigations.

References

https://www.synology.com/security/advisory/Synology_SA_18_30
https://www.synology.com/security/advisory/Synology_SA_18_30

Get alerted when CVE-2018-13283 or the next vulnerability affects your stack