A critical security vulnerability has been identified in Synology VPN Plus servers, which were developed to transform Synology Router solutions into an advanced VPN (virtual private network) server, that could cause threat actors to execute code remotely in affected versions.
The security vulnerability tracked as CVE-2022-43931 is an out-of-bounds write in Remote Desktop Functionality and affects Synology VPN Plus Server versions before 1.4.3-0534 and 1.4.4-0635. The vulnerability could allow remote threat actors to execute arbitrary commands on the vulnerable system without authentication.
Synology Released Patch for Synology VPN Immediately
Synology fixed the vulnerability immediately after being discovered by Synology Product Security Incident Response Team (PSIRT). It has a maximum CVSS score of 10.0 out of 10.
To avoid being the target of attacks that can be carried out using vulnerabilities, it is recommended to upgrade to Synology VPN Plus Server 1.4.3-0534 or 1.4.4-0635 versions.
What is CVE-2022-43931?
The National Vulnerability Database describes CVE-2022-43931 as an out-of-bounds write in the Remote Desktop functionality of Synology VPN Plus Server. It affects versions before 1.4.3-0534 and 1.4.4-0635. A remote attacker can use it to run arbitrary commands through unspecified vectors.
The record was published on 3 January 2023. NVD lists a CVSS 3.1 base score of 10.0, the top of the scale. The vector shows that the attack works over the network, needs no privileges, needs no user action, and can reach beyond the vulnerable component.
What did Synology say?
Synology covers the issue in security advisory Synology_SA_22_26. As noted above, the company fixed the flaw after its Product Security Incident Response Team (PSIRT) found it. The fixed releases are VPN Plus Server 1.4.3-0534 and 1.4.4-0635.
Why is a score of 10.0 serious for a VPN server?
A VPN server is meant to be reachable from outside, so it cannot hide behind other layers. A flaw that needs no login and allows command execution gives an attacker a path straight to a device that connects remote users to the network. From there, an attacker could look for other systems on the same network.
Because the score is 10.0, this is not a flaw to leave for the next maintenance window. Patch first, then review what else is exposed.
What should you do now?
- Check the version of Synology VPN Plus Server. If it is older than 1.4.3-0534 or 1.4.4-0635, upgrade to the matching fixed version.
- Check whether the Remote Desktop feature of VPN Plus is needed. If it is not, turn it off.
- Review the logs of the VPN server and the router for unexpected commands or logins.
- Keep a list of every device in your network that offers a service to the internet, so the next alert can be checked in minutes.
Brandefense follows alerts like this as part of its cyber threat intelligence work. See more in our security news archive.