CVE-2022-43931

—

CVSS 3.1

10.0 critical

EPSS

17%p97

Published

Jan 3, 2023 (Jan 3, 2023)

Modified

Jun 17, 2026

Description

Out-of-bounds write vulnerability in Remote Desktop Functionality in Synology VPN Plus Server before 1.4.3-0534 and 1.4.4-0635 allows remote attackers to execute arbitrary commands via unspecified vectors.

Vendors: synology
Products: vpn plus server
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (16.8%)

In the news2 stories

Synology Releases Patch for Critical RCE Vulnerability Affecting VPN Plus Servers

The Hacker NewsJan 5, 04:05 UTC · Jan 5, 2023Vulnerability CVE-2022-43931

Synology fixes multiple critical vulnerabilities in its routers

Security AffairsJan 3, 21:19 UTC · Jan 3, 2023Vulnerability CVE-2022-43931