exploit/linux/http/terramaster_unauth_rce_cve_2020_35665

weaponized

TerraMaster TOS 4.2.06 or lower - Unauthenticated Remote Code Execution

view exploit source metasploittype exploitpublished 2020-12-12catalog metasploit

exploited CVEs (2)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2020-28188US	critical9.8	96.4% (100th)	Exploit	2020-12-24
Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php in Event parameter.
CVE-2020-35665US	critical9.8	78.5% (100th)	Exploit	2020-12-23
An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter in include/makecvs.php during CSV creati…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.