Synology SSL VPN Client Files Access Vulnerability

A vulnerability allowing remote access to sensitive files in the Synology SSL VPN Client installation directory has been identified. This issue affects versions prior to 1.4.5-0684. The vulnerability arises from a local HTTP server bound to the loopback interface, which can be exploited by remote attackers. By crafting a specific web page and leveraging user interaction, attackers may retrieve confidential files such as configuration files, certificates, and logs, leading to unauthorized information disclosure.

Impact

Exploitation of this vulnerability could result in unauthorized access to sensitive files, including configuration files, certificates, and logs, from the affected user's system.

Remediation

Users are advised to upgrade to Synology SSL VPN Client version 1.4.5-0684 or above.