Information disclosure in Synology Diskstation Manager

CVE-2014-2264

The OpenVPN module in Synology DiskStation Manager (DSM) 4.3-3810 update 1 has a hardcoded root password of synopass, which makes it easier for remote attackers to obtain access via a VPN session.

Vulnerability class: Information Disclosure

EPSS: 0.017 (74.4th percentile) — read the EPSS interpretation.

Affected products

Synology Diskstation_manager — versions 4.3-3810
N/a — versions n/a

Weakness classification (CWE)

References

cve@mitre.org (x_refsource_MISC)
cve@mitre.org (US Government Resource, x_refsource_CERT-VN, third-party-advisory)