CVE-2021-47961
Synology Ssl Vpn Client ≤ 1.4.5-0684
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NSummary
CVE-2021-47961 is a high-severity Plaintext Storage of a Password (CWE-256) vulnerability in Synology Ssl Vpn Client. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Credentials In Files (T1552.001); ranked at the 25th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) and SC-28 (Protection of Information at Rest) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2021-47961 is a plaintext storage of a password vulnerability (CWE-256) in Synology SSL VPN Client versions before 1.4.5-0684. The flaw stems from insecure storage that exposes the user's PIN code to remote attackers, who can access or influence it.
Remote attackers can exploit this over the network with low attack complexity, no privileges, and user interaction required, as indicated by the CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). Exploitation allows high-impact confidentiality and integrity violations, such as unauthorized VPN configuration and potential interception of subsequent VPN traffic when paired with user interaction.
Synology's security advisory (https://www.synology.com/en-global/security/advisory/Synology_SA_26_05) details mitigation, recommending an update to Synology SSL VPN Client version 1.4.5-0684 or later to address the insecure storage issue.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-34779
Vulnerability Data
A plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access or influence the user's PIN code due to insecure storage. This may lead to unauthorized VPN configuration and potential interception of…
more
subsequent VPN traffic when combined with user interaction.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct match to insecure plaintext credential storage (CWE-256) enabling credential theft from client files/config.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Requires cryptographic mechanisms to protect sensitive information like PIN codes at rest, directly preventing plaintext storage exploitation.
Mandates secure management and protection of authenticators such as PIN codes, addressing insecure storage of VPN credentials.
Requires timely flaw remediation including patching Synology SSL VPN Client to version 1.4.5-0684 or later to fix the plaintext storage vulnerability.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Encryption and hashing of data-at-rest directly prevent plaintext password storage in files.
Credential management practices normally include secure storage requirements for passwords.
Protecting data-in-use can limit exposure of passwords held in memory.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Directly requires secure handling and protection of authentication information, preventing plaintext password storage.
Requires use of cryptography to protect sensitive data such as passwords at rest.
Secure coding practices would prevent developers from writing code that stores passwords in plaintext.
Mandates secure authentication mechanisms that inherently require hashed or encrypted credentials rather than plaintext.
Requires secure deletion of sensitive information, indirectly reducing exposure of stored plaintext passwords.