Tos

Hardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail or webmail server. These credentials can also be used to login to the administration panel and to perform privileged actions.

Published: 2024-06-14T00:00:00.000Z
Updated: 2024-08-02T02:59:20.976Z

Incorrect Access Control vulnerability in TerraMaster TOS <= 4.2.06 allows remote authenticated attackers to bypass read-only restriction and obtain full access to any folder within the NAS

Published: 2020-12-24T14:36:59.000Z
Updated: 2024-08-04T16:48:01.685Z

TerraMaster TOS <= 4.2.06 was found to check for updates (of both system and applications) via an insecure channel (HTTP). Man-in-the-middle attackers are able to intercept these requests and serve a weaponized/infected version of applications or updates.

Published: 2020-12-24T14:34:32.000Z
Updated: 2024-08-04T16:33:57.797Z

Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php in Event parameter.

Published: 2020-12-24T00:00:00.000Z
Updated: 2024-08-04T16:33:58.217Z

Multiple directory traversal vulnerabilities in TerraMaster TOS <= 4.2.06 allow remote authenticated attackers to read, edit or delete any file within the filesystem via the (1) filename parameter to /tos/index.php?editor/fileGet, Event parameter to /include/ajax/logtable.php, or opt parameter to /include/core/index.php.

Published: 2020-12-24T14:31:58.000Z
Updated: 2024-08-04T16:33:58.311Z

Email Injection in TerraMaster TOS <= 4.2.06 allows remote unauthenticated attackers to abuse the forget password functionality and achieve account takeover.

Published: 2020-12-24T14:30:11.000Z
Updated: 2024-08-04T16:33:57.924Z

User Enumeration vulnerability in TerraMaster TOS <= 4.2.06 allows remote unauthenticated attackers to identify valid users within the system via the username parameter to wizard/initialise.php.

Published: 2020-12-24T14:26:55.000Z
Updated: 2024-08-04T16:33:57.804Z

Cross-site scripting (XSS) vulnerability in TerraMaster TOS <= 4.2.06 allows remote authenticated users to inject arbitrary web script or HTML via the mod parameter to /module/index.php.

Published: 2020-12-24T14:28:16.000Z
Updated: 2024-08-04T16:33:57.796Z

TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with (for example) OS commands in the opt parameter.

Published: 2021-01-30T04:59:40.000Z
Updated: 2024-08-04T13:22:29.264Z