What’s Vulnerable › Vulnerabilities
CVE-2021-47960
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-04-10 · updated 2026-06-17
- Weakness: CWE-552
Description
A files or directories accessible to external parties vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access files within the installation directory via a local HTTP server bound to the loopback interface. By leveraging user interaction with a crafted web page, attackers may retrieve sensitive files such as configuration files, certificates, and logs, leading to information disclosure.
Affected products
- Synology SSL VPN Client: before 1.4.5-0684 — fixed in 1.4.5-0684
How to fix
Upgrade to a fixed version: Synology SSL VPN Client 1.4.5-0684. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2021-47960 or the next vulnerability affects your stack