Lucene search

CVE-2020-35665

🗓️ 23 Dec 2020 00:00:00Reported by AttackerKBType

An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter in include/makecvs.php during CSV creatio

Reporter	Title	Published	Views	Family All 59
AttackerKB	CVE-2022-24990	7 Feb 202300:00	–	attackerkb
AttackerKB	CVE-2021-45837	25 Apr 202200:00	–	attackerkb
AttackerKB	CVE-2020-28188	24 Dec 202000:00	–	attackerkb
AttackerKB	CVE-2020-7961	20 Mar 202000:00	–	attackerkb
Packet Storm	TerraMaster TOS 4.2.06 Remote Code Execution	12 Jun 202300:00	–	packetstorm
Packet Storm	TerraMaster TOS 4.2.29 Remote Code Execution	13 Jun 202300:00	–	packetstorm
Packet Storm	TerraMaster TOS 4.2.15 Remote Code Execution	12 Jun 202300:00	–	packetstorm
Metasploit	TerraMaster TOS 4.2.06 or lower - Unauthenticated Remote Code Execution	5 Jun 202311:19	–	metasploit
Metasploit	TerraMaster TOS 4.2.29 or lower - Unauthenticated RCE chaining CVE-2022-24990 and CVE-2022-24989	10 Jun 202309:42	–	metasploit
Metasploit	TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting.	6 Jun 202307:07	–	metasploit

Source	Link
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
exploit-db	www.exploit-db.com/exploits/49330
pentest	www.pentest.com.tr/exploits/TerraMaster-TOS-4-2-06-Unauthenticated-Remote-Code-Execution.html
packetstormsecurity	www.packetstormsecurity.com/files/172880/TerraMaster-TOS-4.2.06-Remote-Code-Execution.html

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

23 Dec 2020 00:00Current

9.1High risk

Vulners AI Score9.1

CVSS210

CVSS39.8

EPSS0.94401