Synology SSL VPN Client Vulnerabilities Let Remote Attackers Access Sensitive Files

Synology released fixes for two vulnerabilities in its SSL VPN Client that allow an attacker who tricks a user into visiting a malicious webpage to silently retrieve sensitive files (via a local loopback HTTP server) and extract improperly stored PIN credentials, potentially enabling unauthorized VPN configurations and interception of VPN traffic; administrators should upgrade to version 1.4.5-0684 or later immediately, as no workarounds are currently available.