CVE-2021-47961

CVE-2021-47961 is a plaintext password storage vulnerability affecting Synology SSL VPN Client versions prior to 1.4.5-0684, where PIN codes and credentials are insecurely stored, allowing remote attackers to recover authentication secrets. This weakness becomes particularly dangerous when combined with user interaction, potentially enabling unauthorized VPN configuration changes and interception of subsequent VPN traffic. The vulnerability carries a HIGH severity rating (CVSS 8.1) with a network-based attack vector requiring minimal complexity and low user interaction to exploit. While it does not enable denial of service, the attack successfully compromises both confidentiality and integrity of VPN configurations, representing a significant risk to users relying on this client for secure remote access. There is currently no evidence of active exploitation in the wild, as the vulnerability does not appear on CISA's Known Exploited Vulnerabilities list. The EPSS score of 0.00044 suggests low near-term exploitation probability, and community attention remains limited. However, organizations using affected Synology SSL VPN Client versions should prioritize upgrading to version 1.4.5-0684 or later to eliminate this plaintext credential storage weakness.