f2-210 Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/f2-210/ Thu, 23 Feb 2023 14:12:59 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png f2-210 Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/f2-210/ 32 32 CVE-2021-45836 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-45836/ Thu, 23 Feb 2023 14:12:59 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-45836/ An authenticated attacker can execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by injecting a maliciously crafted input in the request through /tos/index.php?app/hand_app.

The post CVE-2021-45836 appeared first on CVE Vulnerability.

]]> An authenticated attacker can execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by injecting a maliciously crafted input in the request through /tos/index.php?app/hand_app.

The post CVE-2021-45836 appeared first on CVE Vulnerability.

]]> CVE-2021-45837 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-45837/ Thu, 23 Feb 2023 14:12:59 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-45837/ It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by sending a specifically crafted input to /tos/index.php?app/del.

The post CVE-2021-45837 appeared first on CVE Vulnerability.

]]> It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by sending a specifically crafted input to /tos/index.php?app/del.

The post CVE-2021-45837 appeared first on CVE Vulnerability.

]]> CVE-2021-45839 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-45839/ Thu, 23 Feb 2023 14:12:59 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-45839/ It is possible to obtain the first administrator’s hash set up on the system in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) as well as other information such as MAC address, internal IP address etc. by performing a request to the /module/api.php?mobile/webNasIPS endpoint.

The post CVE-2021-45839 appeared first on CVE Vulnerability.

]]> It is possible to obtain the first administrator’s hash set up on the system in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) as well as other information such as MAC address, internal IP address etc. by performing a request to the /module/api.php?mobile/webNasIPS endpoint.

The post CVE-2021-45839 appeared first on CVE Vulnerability.

]]> CVE-2021-45840 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-45840/ Thu, 23 Feb 2023 14:12:59 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-45840/ It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by sending specifically crafted input to /tos/index.php?app/app_start_stop.

The post CVE-2021-45840 appeared first on CVE Vulnerability.

]]> It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by sending specifically crafted input to /tos/index.php?app/app_start_stop.

The post CVE-2021-45840 appeared first on CVE Vulnerability.

]]> CVE-2021-45841 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-45841/ Thu, 23 Feb 2023 14:12:59 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-45841/ In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can self-sign session cookies by knowing the target’s MAC address and the user’s password hash. Guest users (disabled by default) can be abused using a null/empty hash and allow an unauthenticated attacker to login as guest.

The post CVE-2021-45841 appeared first on CVE Vulnerability.

]]> In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can self-sign session cookies by knowing the target’s MAC address and the user’s password hash. Guest users (disabled by default) can be abused using a null/empty hash and allow an unauthenticated attacker to login as guest.

The post CVE-2021-45841 appeared first on CVE Vulnerability.

]]> CVE-2021-45842 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-45842/ Thu, 23 Feb 2023 14:12:59 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-45842/ It is possible to obtain the first administrator’s hash set up in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) on the system as well as other information such as MAC address, internal IP address etc. by performing a request to the /module/api.php?mobile/wapNasIPS endpoint.

The post CVE-2021-45842 appeared first on CVE Vulnerability.

]]> It is possible to obtain the first administrator’s hash set up in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) on the system as well as other information such as MAC address, internal IP address etc. by performing a request to the /module/api.php?mobile/wapNasIPS endpoint.

The post CVE-2021-45842 appeared first on CVE Vulnerability.

]]> CVE-2022-24990 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-24990/ Thu, 23 Feb 2023 05:17:33 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-24990/ TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending “User-Agent: TNAS” to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.

The post CVE-2022-24990 appeared first on CVE Vulnerability.

]]> TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending “User-Agent: TNAS” to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.

The post CVE-2022-24990 appeared first on CVE Vulnerability.

]]>