CVE-2020-28186

Email Injection in TerraMaster TOS = 4.2.06 allows remote unauthenticated attackers to abuse the forget password functionality and achieve account takeover...

CVE-2020-28184

TerraMaster TOS vulnerable to Cross-site scripting (XSS) in versions 4.2.06 and earlier. The flaw allows remote authenticated users to inject arbitrary web script or HTML via the mod parameter to /module/index.php. This is documented across multiple sources (NVD, CNVD, Red Hat, CNVD CNVD-2020-751...

CVE-2020-28184

Cross-site scripting XSS vulnerability in TerraMaster TOS = 4.2.06 allows remote authenticated users to inject arbitrary web script or HTML via the mod parameter to /module/index.php...

CVE-2020-28185

User Enumeration vulnerability in TerraMaster TOS = 4.2.06 allows remote unauthenticated attackers to identify valid users within the system via the username parameter to wizard/initialise.php...

CVE-2020-28185

CVE-2020-28185 affects TerraMaster TOS (older than or equal to 4.2.06). The vulnerability allows remote, unauthenticated attackers to enumerate valid usernames through the username parameter on wizard/initialise.php. This user enumeration could facilitate targeted credential or further intra-syst...

PT-2020-16941

Name of the Vulnerable Software and Affected Versions TerraMaster TOS versions prior to 4.2.07 Description The issue allows remote unauthenticated attackers to abuse the forget password functionality, which can lead to account takeover. Recommendations For versions prior to 4.2.07, update to...

PT-2020-16944

Name of the Vulnerable Software and Affected Versions TerraMaster TOS versions prior to 4.2.07 Description The issue allows man-in-the-middle attackers to intercept update requests and serve malicious updates or applications, as the update checks are performed via an insecure channel, specificall...

CVE-2020-28185: Undefined Security Weakness

User Enumeration vulnerability in TerraMaster TOS = 4.2.06 allows remote unauthenticated attackers to identify valid users within the system via the username parameter to wizard/initialise.php...

PT-2020-16939

Name of the Vulnerable Software and Affected Versions TerraMaster TOS versions 4.2.06 and earlier Description The issue allows remote authenticated users to inject arbitrary web script or HTML via the mod parameter to "/module/index.php" API endpoint. This enables attackers to execute malicious...

TerraMaster TOS Remote Code Execution Vulnerability

TerraMaster TOS is a Linux-based operating system developed for TerraMaster Cloud Storage NAS servers. A remote code execution vulnerability exists in TerraMaster TOS 4.2.06 and earlier versions. An attacker can exploit this vulnerability to execute commands without authentication via shell...

Terramaster TOS Security Vulnerability

Terramaster TOS is a Linux-based operating system from Shenzhen, China-based Tumi Electronic Technology Terramaster dedicated to the erraMaster Cloud Storage NAS server. A security vulnerability exists in TerraMaster TOS version 4.2.06 and earlier versions, which can be exploited by an attacker t...

PT-2020-16942

Name of the Vulnerable Software and Affected Versions TerraMaster TOS versions 4.2.06 and earlier Description The issue allows remote authenticated attackers to read, edit, or delete any file within the filesystem. This can be achieved via the filename parameter to "/tos/index.php?editor/fileGet"...

Terramaster TOS Access Control Error Vulnerability

Terramaster TOS is a Linux-based operating system dedicated to the erraMaster Cloud Storage NAS server from Shenzhen Tumi Electronic Technology Terramaster Company in China. An access control error vulnerability exists in TerraMaster TOS version 4.2.06 and earlier versions, which can be exploited...

CVE-2020-28184: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in TerraMaster TOS = 4.2.06 allows remote authenticated users to inject arbitrary web script or HTML via the mod parameter to /module/index.php...

CVE-2020-28190: Undefined Security Weakness

TerraMaster TOS = 4.2.06 was found to check for updates of both system and applications via an insecure channel HTTP. Man-in-the-middle attackers are able to intercept these requests and serve a weaponized/infected version of applications or updates...

CVE-2020-28187: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in TerraMaster TOS = 4.2.06 allow remote authenticated attackers to read, edit or delete any file within the filesystem via the 1 filename parameter to /tos/index.php?editor/fileGet, Event parameter to /include/ajax/logtable.php, or opt parameter to...

CVE-2020-29189: Undefined Security Weakness

Incorrect Access Control vulnerability in TerraMaster TOS = 4.2.06 allows remote authenticated attackers to bypass read-only restriction and obtain full access to any folder within the NAS...

CVE-2020-28186: Weak Password Recovery Mechanism for Forgotten Password

Email Injection in TerraMaster TOS = 4.2.06 allows remote unauthenticated attackers to abuse the forget password functionality and achieve account takeover...

CVE-2020-28188: Improper Neutralization of Special Elements used in an OS Command

Remote Command Execution RCE vulnerability in TerraMaster TOS = 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php in Event parameter...

CVE-2020-28188

Remote Command Execution RCE vulnerability in TerraMaster TOS = 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php in Event parameter. Recent assessments: gwillcox-r7 at January 21, 2021 3:28am UTC reported: Noted as exploited in the wild by CheckPoint...