CVE-2021-47961
Synology Ssl Vpn Client ≤ 1.4.5-0684
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2021-47961 is a high-severity Plaintext Storage of a Password (CWE-256) vulnerability in Synology Ssl Vpn Client. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unsecured Credentials (T1552); ranked at the 25th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-28 (Protection of Information at Rest) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2021-47961 is a plaintext storage of a password vulnerability (CWE-256) in Synology SSL VPN Client versions before 1.4.5-0684. The flaw stems from insecure storage that exposes the user's PIN code to remote attackers, who can access or influence it.
Remote attackers can exploit this over the network with low attack complexity, no privileges, and user interaction required, as indicated by the CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). Exploitation allows high-impact confidentiality and integrity violations, such as unauthorized VPN configuration and potential interception of subsequent VPN traffic when paired with user interaction.
Synology's security advisory (https://www.synology.com/en-global/security/advisory/Synology_SA_26_05) details mitigation, recommending an update to Synology SSL VPN Client version 1.4.5-0684 or later to address the insecure storage issue.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-34779
Vulnerability Data
A plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access or influence the user's PIN code due to insecure storage. This may lead to unauthorized VPN configuration and potential interception of…
more
subsequent VPN traffic when combined with user interaction.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requiring confidentiality protection of information at rest directly stops passwords from being stored in plaintext.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Credential management practices normally include secure storage requirements for passwords.
Encryption and hashing of data-at-rest directly prevent plaintext password storage in files.
Protecting data-in-use can limit exposure of passwords held in memory.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Directly requires secure handling and protection of authentication information, preventing plaintext password storage.
Requires use of cryptography to protect sensitive data such as passwords at rest.
Secure coding practices would prevent developers from writing code that stores passwords in plaintext.
Mandates secure authentication mechanisms that inherently require hashed or encrypted credentials rather than plaintext.
Requires secure deletion of sensitive information, indirectly reducing exposure of stored plaintext passwords.