CVE-2022-43931

Severity: critical (CVSS 10.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 16.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-01-03 · updated 2026-06-17

Description

Out-of-bounds write vulnerability in Remote Desktop Functionality in Synology VPN Plus Server before 1.4.3-0534 and 1.4.4-0635 allows remote attackers to execute arbitrary commands via unspecified vectors.

Affected products

Synology VPN Plus Server: before 1.4.3-0534; before 1.4.4-0635 — fixed in 1.4.3-0534, 1.4.4-0635

How to fix

Upgrade to a fixed version: Synology VPN Plus Server 1.4.3-0534, 1.4.4-0635. Check the vendor advisory for mitigations.

References

https://www.synology.com/en-global/security/advisory/Synology_SA_22_26
https://www.synology.com/en-global/security/advisory/Synology_SA_22_26

Get alerted when CVE-2022-43931 or the next vulnerability affects your stack