CVE-2022-24990

CVE-2022-24990 描述 - CVE-2022-24990 的 POC：通过 PHP 对象实例化在 TerraMaster TOS 中实现未认证远程命令执行。 - 由 antx 于 2022-04-12 创建。 详情 - 该漏洞允许远程攻击者在目标系统上执行任意命令。 - 该漏洞是由于 api.php 脚本中的 webNasIPS 组件对输入验证不当所致。远程未认证攻击者可以向应用程序传递特制数据，并在目标系统上执行任意命令。 - 成功利用此漏洞可能导致易受攻击的系统被完全攻破。 CVE 严重性 - attackComplexity: LOW -...

Default credentials

TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response...

CVE-2021-45839

It is possible to obtain the first administrator's hash set up on the system in Terramaster F4-210, F2-210 TOS 4.2.X 4.2.15-2107141517 as well as other information such as MAC address, internal IP address etc. by performing a request to the /module/api.php?mobile/webNasIPS endpoint...

Exploit for Missing Authentication for Critical Function in Terra-Master Terramaster_Operating_System

It is an exploit module for CVE-2022-24990, a TerraMaster TOS Un...