exploit/linux/http/terramaster_unauth_rce_cve_2021_45837
weaponizedTerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting.
01
exploited CVEs (3)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-45841US | high8.1OT high | Exploit | ||
In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can self-sign session cookies by knowing the target's MAC address and the user's password hash. Guest users… | ||||
| CVE-2021-45839US | medium6.5 | Exploit | ||
It is possible to obtain the first administrator's hash set up on the system in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) as well as other information such as MAC ad… | ||||
| CVE-2021-45837US | critical9.8 | Exploit | ||
It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by sending a specifically crafted input to /tos/index.php?app/del. | ||||
scry
Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.
Free scan