#VU125951 Files or Directories Accessible to External Parties in SSL VPN Client - CVE-2021-47960
Published: April 14, 2026
Vulnerability identifier: #VU125951
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2021-47960
CWE-ID: CWE-552
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
SSL VPN Client
SSL VPN Client
Software vendor:
Synology Inc.
Synology Inc.
Description
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to files or directories accessible to external parties in the local HTTP service bound to the loopback interface when handling requests from a crafted web page. A remote attacker can trick the victim into interacting with a crafted web page to disclose sensitive information.
User interaction is required, and exposed files may include configuration files, certificates, and logs from the installation directory.
Remediation
Install security update from vendor's website.