CVE-2022-43931: Synology VPN Plus Server

Critical severity, CVSS 10.0. EPSS: 16.8% chance of exploitation in the next 30 days.

Out-of-bounds write vulnerability in Remote Desktop Functionality in Synology VPN Plus Server before 1.4.3-0534 and 1.4.4-0635 allows remote attackers to execute arbitrary commands via unspecified vectors.

Affected products

• Synology VPN Plus Server: before 1.4.3-0534 (fixed in 1.4.3-0534); before 1.4.4-0635 (fixed in 1.4.4-0635)

Published 2023-01-03. Last modified 2026-06-17.