7 matches found
CVE-2022-24990
CVE-2022-24990 Description - POC for CVE-2022-24990: TerraMaster TOS unauthenticated remote command execution via PHP Object Instantiation. - create by antx at 2022-04-12. Detail - The vulnerability allows a remote attacker to execute arbitrary commands on the target system. - The vulnerability...
TerraMaster TOS Info Disclosure (CVE-2022-24990)
Exploits CVE-2022-24990 in TerraMaster TOS 4.2.30: User-Agent TNAS on webNasIPS leaks firmware, network config, and admin password hash PWD. !/usr/bin/env python3 -- coding: utf-8 -- """TerraMaster TOS webNasIPS info disclosure CVE-2022-24990.""" import re from kittysploit import from...
Default credentials
TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response...
CVE-2021-45839
It is possible to obtain the first administrator's hash set up on the system in Terramaster F4-210, F2-210 TOS 4.2.X 4.2.15-2107141517 as well as other information such as MAC address, internal IP address etc. by performing a request to the /module/api.php?mobile/webNasIPS endpoint...
CVE-2021-45839
It is possible to obtain the first administrator's hash set up on the system in Terramaster F4-210, F2-210 TOS 4.2.X 4.2.15-2107141517 as well as other information such as MAC address, internal IP address etc. by performing a request to the /module/api.php?mobile/webNasIPS endpoint...
CVE-2021-45839: Undefined Security Weakness
It is possible to obtain the first administrator's hash set up on the system in Terramaster F4-210, F2-210 TOS 4.2.X 4.2.15-2107141517 as well as other information such as MAC address, internal IP address etc. by performing a request to the /module/api.php?mobile/webNasIPS endpoint...
