Improper Certificate Validation in Synology Router Manager Affects OpenVPN Client
CVE-2020-27649

8.3HIGH

Key Information:

Vendor
Synology
Status
Synology Router Manager (srm)
Vendor
CVE Published:
29 October 2020

Summary

The OpenVPN client in Synology Router Manager is susceptible to an improper certificate validation vulnerability. This flaw allows man-in-the-middle attackers to exploit the improper verification process, enabling them to spoof legitimate servers. By presenting a specially crafted certificate, attackers can intercept and gain access to sensitive information transmitted between clients and the server, potentially leading to data leaks and compromised security protocols.

Affected Version(s)

Synology Router Manager (SRM) < 1.2.4-8081

References

https://www.synology.com/security/advisory/Synology_SA_20_14
x_refsource_CONFIRM
https://www.talosintelligence.com/vulnerability_reports/T...
x_refsource_MISC

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.