How severe is CVE-2018-13283?

CVE-2018-13283 has a CVSS 3.x base score of 8.8, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2018-13283 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (69th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2018-13283?

CVE-2018-13283 affects Synology Ssl Vpn Client. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2018-13283?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2018-13283 published?

CVE-2018-13283 was published on 2019-04-01 and last updated on 2026-06-17.

CVE-2018-13283

CVE-2018-13283 is a high-severity vulnerability in Synology Ssl Vpn Client with a CVSS 3.x base score of 8.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-671.

Key facts

Severity: High (CVSS 3.x base score 8.8)
CVSS v2: 5.8
EPSS exploit prediction: 1% (69th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-671
Affected product: Synology Ssl Vpn Client
Published: 2019-04-01
Last modified: 2026-06-17

Description

Lack of administrator control over security vulnerability in client.cgi in Synology SSL VPN Client before 1.2.5-0226 allows remote attackers to conduct man-in-the-middle attacks via the (1) command, (2) hostname, or (3) port parameter.

Frequently asked questions

What is CVE-2018-13283?: Lack of administrator control over security vulnerability in client.cgi in Synology SSL VPN Client before 1.2.5-0226 allows remote attackers to conduct man-in-the-middle attacks via the (1) command, (2) hostname, or (3) port parameter.
How severe is CVE-2018-13283?: CVE-2018-13283 has a CVSS 3.x base score of 8.8, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2018-13283 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (69th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2018-13283?: CVE-2018-13283 affects Synology Ssl Vpn Client. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2018-13283?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2018-13283 published?: CVE-2018-13283 was published on 2019-04-01 and last updated on 2026-06-17.

References

https://www.synology.com/security/advisory/Synology_SA_18_30

Affected products (1)

cpe:2.3:a:synology:ssl_vpn_client:*:*:*:*:*:*:*:*

More vulnerabilities in Synology Ssl Vpn Client

CVE-2021-47961 — High (CVSS 8.1): A plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to…
CVE-2018-8929 — High (CVSS 7.3): Improper restriction of communication channel to intended endpoints vulnerability in HTTP daemon in Synology SSL VPN…
CVE-2021-47960 — Medium (CVSS 6.5): A files or directories accessible to external parties vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows…
CVE-2023-5748 — Low (CVSS 3.3): Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology SSL…

All CVEs affecting Synology Ssl Vpn Client →

Other CWE-671 vulnerabilities

CVE-2025-24024 — Critical (CVSS 9.1): Mjolnir is a moderation tool for Matrix. Mjolnir v1.9.0 responds to management commands from any room the bot is member…
CVE-2023-20115 — Medium (CVSS 5.4): A vulnerability in the SFTP server implementation for Cisco Nexus 3000 Series Switches and 9000 Series Switches in…
CVE-2022-29163 — Low (CVSS 3.5): Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions…

Browse all CWE-671 vulnerabilities →