Vulnerabilities > CVE-2018-8929 - Channel and Path Errors vulnerability in Synology SSL VPN Client

CVSS 6.8 - MEDIUM

Attack vector

NETWORK

Attack complexity

MEDIUM

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

PARTIAL

Availability impact

PARTIAL

network

synology

CWE-417

NVD

Published: 2018-07-06

Updated: 2021-05-12

Summary

Improper restriction of communication channel to intended endpoints vulnerability in HTTP daemon in Synology SSL VPN Client before 1.2.4-0224 allows remote attackers to conduct man-in-the-middle attacks via a crafted payload.

Vulnerable Configurations

Part	Description	Count
Application	Synology Synology SSL VPN Client 1.0.0-0075 Synology SSL VPN Client 1.0.0-0076 Synology SSL VPN Client 1.0.1-0084 Synology SSL VPN Client 1.0.2-0087 Synology SSL VPN Client 1.1.0-0127 Synology SSL VPN Client 1.1.1-0131 Synology SSL VPN Client 1.1.2-0142 Synology SSL VPN Client 1.2.0-0211 Synology SSL VPN Client 1.2.1-0212 Synology SSL VPN Client 1.2.2-0215 Synology SSL VPN Client 1.2.3-0219	11

Common Weakness Enumeration (CWE)

CWE-417 - Channel and Path Errors

References

https://www.synology.com/en-global/support/security/Synology_SA_18_19