Terra-master vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2024-34539 Hardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail or webmail server.Critical 9.4 · Jun 14, 2024
• CVE-2022-24989 TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object InstantiaCritical 9.8 · Aug 20, 2023
• CVE-2021-45842 It is possible to obtain the first administrator's hash set up in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) on the system as well as other informHigh 7.5 · Apr 25, 2022
• CVE-2021-45841 In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can self-sign session cookies by knowing the target's MAC address and the user's passwoHigh 8.1 · Apr 25, 2022
• CVE-2021-45840 It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by sending specifically crafted input to /tos/iCritical 9.8 · Apr 25, 2022
• CVE-2021-45837 It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by sending a specifically crafted input to /tosCritical 9.8 · Apr 25, 2022
• CVE-2021-45836 An authenticated attacker can execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by injecting a maliciously crafted High 8.8 · Apr 25, 2022
• CVE-2021-30127 TerraMaster F2-210 devices through 2021-04-03 use UPnP to make the admin web server accessible over the Internet on TCP port 8181, which is arguably inconsistenHigh 7.3 · Apr 3, 2021
• CVE-2020-15568 TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root.Critical 9.8 · Jan 30, 2021
• CVE-2020-29189 Incorrect Access Control vulnerability in TerraMaster TOS <= 4.2.06 allows remote authenticated attackers to bypass read-only restriction and obtain full accessHigh 8.1 · Dec 24, 2020
• CVE-2020-28188 Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php Critical 9.8 · Dec 24, 2020
• CVE-2020-28187 Multiple directory traversal vulnerabilities in TerraMaster TOS <= 4.2.06 allow remote authenticated attackers to read, edit or delete any file within the filesCritical 9.8 · Dec 24, 2020
• CVE-2020-28186 Email Injection in TerraMaster TOS <= 4.2.06 allows remote unauthenticated attackers to abuse the forget password functionality and achieve account takeover.High 7.3 · Dec 24, 2020
• CVE-2020-35665 An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter in include/makecvs.pCritical 9.8 · Dec 23, 2020
• CVE-2019-18195 An issue was discovered on TerraMaster FS-210 4.0.19 devices.High 8.8 · Oct 28, 2019
• CVE-2019-18385 An issue was discovered on TerraMaster FS-210 4.0.19 devices.High 7.5 · Oct 23, 2019
• CVE-2019-18383 An issue was discovered on TerraMaster FS-210 4.0.19 devices.High 7.5 · Oct 23, 2019
• CVE-2018-13418 System command injection in ajaxdata.php in TerraMaster TOS 3.1.03 allows attackers to execute system commands via the "newname" parameter.High 8.8 · Nov 27, 2018
• CVE-2018-13359 Cross-site scripting in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "modgroup" parameter.High 8.8 · Nov 27, 2018
• CVE-2018-13358 System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "checkName" parameter.High 8.8 · Nov 27, 2018
• CVE-2018-13356 Incorrect access control on ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to elevate user permissions.High 8.8 · Nov 27, 2018
• CVE-2018-13354 System command injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "Event" parameter.Critical 9.8 · Nov 27, 2018
• CVE-2018-13353 System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute commands via the "checkport" parameter.High 8.8 · Nov 27, 2018
• CVE-2018-13352 Session Exposure in the web application for TerraMaster TOS version 3.1.03 allows attackers to view active session tokens in a world-readable directory.High 7.5 · Nov 27, 2018
• CVE-2018-13350 SQL injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute SQL queries via the "Event" parameter.Critical 9.8 · Nov 27, 2018