CVE-2018-13283
High
Description
Lack of administrator control over security vulnerability in client.cgi in Synology SSL VPN Client before 1.2.5-0226 allows remote attackers to conduct man-in-the-middle attacks via the (1) command, (2) hostname, or (3) port parameter.
SeverityHigh
CVSS8.8
Exploit probability—
ProductSynology Ssl Vpn Client
PublishedApr 1, 2019
First seenApr 1, 2019
Weakness typeCWE-671CWE-671
How to fix
Update
- synology ssl_vpn_client1.2.5-0226 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| synology ssl_vpn_client | v < 1.2.5-0226 | 1.2.5-0226 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.