TerraMaster F2-210 Information Disclosure Vulnerability (CNVD-2019-38804)

The Terramaster F2-210 is an entry-level two-drive NAS. An information disclosure vulnerability exists in the TerraMaster F2-210. An attacker can exploit this vulnerability to download backup files from terramasterTNAS-00E43Aconfigbackup.bin without permission...

CVE-2019-18385

An issue was discovered on TerraMaster FS-210 4.0.19 devices. An unauthenticated attacker can download log files via the include/makecvs.php?Event= substring...

CVE-2019-18384

An issue was discovered on TerraMaster FS-210 4.0.19 devices. An authenticated remote non-administrative user can read unauthorized shared files, as demonstrated by the filename=public%25252FadminOnlyRead.txt substring...

CVE-2019-18385

An issue was discovered on TerraMaster FS-210 4.0.19 devices. An unauthenticated attacker can download log files via the include/makecvs.php?Event= substring...

CVE-2019-18384

An issue was discovered on TerraMaster FS-210 4.0.19 devices. An authenticated remote non-administrative user can read unauthorized shared files, as demonstrated by the filename=public%25252FadminOnlyRead.txt substring...

CVE-2019-18383

An issue was discovered on TerraMaster FS-210 4.0.19 devices. One can download backup files remotely from terramasterTNAS-00E43Aconfigbackup.bin without permission...

CVE-2019-18383

An issue was discovered on TerraMaster FS-210 4.0.19 devices. One can download backup files remotely from terramasterTNAS-00E43Aconfigbackup.bin without permission...

Design/Logic Flaw

An issue was discovered on TerraMaster FS-210 4.0.19 devices. One can download backup files remotely from terramasterTNAS-00E43Aconfigbackup.bin without permission...

Design/Logic Flaw

An issue was discovered on TerraMaster FS-210 4.0.19 devices. An authenticated remote non-administrative user can read unauthorized shared files, as demonstrated by the filename=public%25252FadminOnlyRead.txt substring...

Code injection

An issue was discovered on TerraMaster FS-210 4.0.19 devices. An unauthenticated attacker can download log files via the include/makecvs.php?Event= substring...

CVE-2019-18383

An issue was discovered on TerraMaster FS-210 4.0.19 devices. One can download backup files remotely from terramasterTNAS-00E43Aconfigbackup.bin without permission...

CVE-2019-18383

TerraMaster FS-210 devices running firmware 4.0.19 are affected by CVE-2019-18383, an information-disclosure flaw that allows remote retrieval of the backup file terramaster_TNAS-00E43A_config_backup.bin without authentication. The issue is documented across multiple sources (NVD/Red Hat/CNVD/etc...

CVE-2019-18384

CVE-2019-18384 affects TerraMaster FS-210 devices (4.0.19). An authenticated remote non-administrative user can read unauthorized shared files, as shown by the substring filename=public %25252Fadmin_OnlyRead.txt. The connected RH Red Hat and CNVD/CVE records corroborate an information disclosure ...

CVE-2019-18384

An issue was discovered on TerraMaster FS-210 4.0.19 devices. An authenticated remote non-administrative user can read unauthorized shared files, as demonstrated by the filename=public%25252FadminOnlyRead.txt substring...

CVE-2019-18385

An issue was discovered on TerraMaster FS-210 4.0.19 devices. An unauthenticated attacker can download log files via the include/makecvs.php?Event= substring...

CVE-2019-18385

The CVE relates to TerraMaster FS-210 devices running 4.0.19 where an unauthenticated attacker can download log files through the include/makecvs.php?Event= substring. This is an information-disclosure vulnerability affecting the NAS’s web-accessible log files; the root cause is an insecure endpo...

CVE-2019-18385: Insertion of Sensitive Information into Log File

An issue was discovered on TerraMaster FS-210 4.0.19 devices. An unauthenticated attacker can download log files via the include/makecvs.php?Event= substring...

PT-2019-15389

Name of the Vulnerable Software and Affected Versions TerraMaster FS-210 version 4.0.19 Description An issue allows remote download of backup files, specifically terramaster TNAS-00E43A config backup.bin, without permission. Recommendations For TerraMaster FS-210 version 4.0.19, restrict access t...

PT-2019-15390

Name of the Vulnerable Software and Affected Versions TerraMaster FS-210 version 4.0.19 Description An issue allows an authenticated remote non-administrative user to read unauthorized shared files. This is demonstrated by using the filename=public%25252Fadmin OnlyRead.txt substring...

PT-2019-15391

Name of the Vulnerable Software and Affected Versions TerraMaster FS-210 version 4.0.19 Description An issue allows an unauthenticated attacker to download log files. This can be achieved via the "include/makecvs.php?Event=" substring, which is likely an API endpoint. The Event variable seems to ...