Terra-master vulnerabilities
We track 3 vulnerabilities in Terra-master products across 2 products. 3 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on June 14, 2024.
Latest Terra-master vulnerabilities
- 9.4 Critical severity
tos: Use of Hard-coded Password
Hardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail or webmail server. These credentials can also be used to login to the administration panel and to perform privileged actions.
- 9.8 Critical severity
terramaster_operating_system: Improper Neutralization of Special Elements in Output Used by a Downstream Component
TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. (Shell metacharacters can be placed in raidtype because p
- 7.5 High severity
TerraMaster OS Remote Command Execution Exploited
TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.