Improper certificate validation vulnerability in OpenVPN client in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
References
Link | Resource |
---|---|
https://www.synology.com/security/advisory/Synology_SA_20_18 | Vendor Advisory |
https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1058 | Exploit Third Party Advisory |
https://www.synology.com/security/advisory/Synology_SA_20_18 | Vendor Advisory |
https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1058 | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 05:21
Type | Values Removed | Values Added |
---|---|---|
References | () https://www.synology.com/security/advisory/Synology_SA_20_18 - Vendor Advisory | |
References | () https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1058 - Exploit, Third Party Advisory | |
CVSS |
v2 : v3 : |
v2 : 6.8
v3 : 8.3 |
Information
Published : 2020-10-29 09:15
Updated : 2024-11-21 05:21
NVD link : CVE-2020-27648
Mitre link : CVE-2020-27648
CVE.ORG link : CVE-2020-27648
JSON object : View
Products Affected
synology
- skynas
- skynas_firmware
- diskstation_manager
CWE
CWE-295
Improper Certificate Validation