Synology Note Station Client users may have their login credentials exposed when the client transmits data in cleartext. The flaw, identified as CWE‑319, permits an attacker positioned between the client and server to capture authentication details before they reach the backend. This jeopardizes the confidentiality of all user sessions and can lead to full account compromise if no additional safeguards are in place.

The vulnerability affects Synology Note Station Client versions prior to 2.2.4‑703. Any installation of the client on endpoints that communicate over unsecured channels is susceptible. Synology’s official release notes indicate that the issue was fixed in the 2.2.4‑703 build; no other affected products are listed.

The CVSS score of 5.9 signals moderate severity, and the lack of an EPSS rating suggests limited publicly visible exploitation data. Because the attack requires a man‑in‑the‑middle position to intercept cleartext traffic, the risk is contingent on network exposure. The vulnerability is not in CISA’s KEV catalog, indicating no confirmed widespread attacks yet, but the medium CVSS and possibility of credential leakage warrant prompt action.