CVE-2020-28188

Remote Command Execution RCE vulnerability in TerraMaster TOS = 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php in Event parameter. Recent assessments: gwillcox-r7 at January 21, 2021 3:28am UTC reported: Noted as exploited in the wild by CheckPoint...

Terramaster TOS Permission License and Access Control Issues Vulnerability

Terramaster TOS is a Linux-based operating system dedicated to the erraMaster Cloud Storage NAS server from Shenzhen Tumi Electronic Technology Terramaster in China. A security vulnerability exists in TerraMaster TOS version 4.2.06 and earlier versions, which can be exploited by a remote,...

PT-2020-16944

Name of the Vulnerable Software and Affected Versions TerraMaster TOS versions prior to 4.2.07 Description The issue allows man-in-the-middle attackers to intercept update requests and serve malicious updates or applications, as the update checks are performed via an insecure channel, specificall...

PT-2020-16940

Name of the Vulnerable Software and Affected Versions TerraMaster TOS versions 4.2.06 and earlier Description The issue allows remote unauthenticated attackers to identify valid users within the system. This is achieved via the username parameter to the "wizard/initialise.php" endpoint...

PT-2020-16941

Name of the Vulnerable Software and Affected Versions TerraMaster TOS versions prior to 4.2.07 Description The issue allows remote unauthenticated attackers to abuse the forget password functionality, which can lead to account takeover. Recommendations For versions prior to 4.2.07, update to...

CVE-2020-28186: Weak Password Recovery Mechanism for Forgotten Password

Email Injection in TerraMaster TOS = 4.2.06 allows remote unauthenticated attackers to abuse the forget password functionality and achieve account takeover...

CVE-2020-28187: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in TerraMaster TOS = 4.2.06 allow remote authenticated attackers to read, edit or delete any file within the filesystem via the 1 filename parameter to /tos/index.php?editor/fileGet, Event parameter to /include/ajax/logtable.php, or opt parameter to...

CVE-2020-28188: Improper Neutralization of Special Elements used in an OS Command

Remote Command Execution RCE vulnerability in TerraMaster TOS = 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php in Event parameter...

CVE-2020-29189: Undefined Security Weakness

Incorrect Access Control vulnerability in TerraMaster TOS = 4.2.06 allows remote authenticated attackers to bypass read-only restriction and obtain full access to any folder within the NAS...

CVE-2020-28184: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in TerraMaster TOS = 4.2.06 allows remote authenticated users to inject arbitrary web script or HTML via the mod parameter to /module/index.php...

PT-2020-16942

Name of the Vulnerable Software and Affected Versions TerraMaster TOS versions 4.2.06 and earlier Description The issue allows remote authenticated attackers to read, edit, or delete any file within the filesystem. This can be achieved via the filename parameter to "/tos/index.php?editor/fileGet"...

Terramaster TOS Security Vulnerability

Terramaster TOS is a Linux-based operating system from Shenzhen, China-based Tumi Electronic Technology Terramaster dedicated to the erraMaster Cloud Storage NAS server. A security vulnerability exists in TerraMaster TOS version 4.2.06 and earlier versions, which can be exploited by an attacker t...

CVE-2020-35665

An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter in include/makecvs.php during CSV creation...

CVE-2020-35665

An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter in include/makecvs.php during CSV creation...

Command injection

An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter in include/makecvs.php during CSV creation...

CVE-2020-35665

An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter in include/makecvs.php during CSV creation...

PT-2020-17380 · Terramaster · Terramaster Tos

Name of the Vulnerable Software and Affected Versions: TerraMaster TOS versions 4.2.06 and earlier Description: An unauthenticated command-execution issue exists via shell metacharacters in the Event parameter in include/makecvs.php during CSV creation. Recommendations: For TerraMaster TOS versio...

TerraMaster TOS 4.2.06 Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "TerraMaster TOS 4.2.06 - Unauthenticated Remote Code Execution", 'Description' = %q This module exploits a unauthenticated command execution...

TerraMaster TOS 4.2.06 Remote Code Execution

Exploit Title: TerraMaster TOS 4.2.06 - RCE Unauthenticated Date: 12/12/2020 Exploit Author: IHTeam Full Write-up: https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/ Vendor Homepage: https://www.terra-master.com/ Version: " /usr/w...

CVE-2020-35665

Summary: CVE-2020-35665 affects TerraMaster TOS 4.2.06 and earlier. An unauthenticated remote code execution is possible via shell metacharacters in the Event parameter processed during CSV creation in include/makecvs.php. The vulnerability allows an attacker to execute commands on the system wit...