CVE-2021-30127

TerraMaster F2-210 devices through 2021-04-03 use UPnP to make the admin web server accessible over the Internet on TCP port 8181, which is arguably inconsistent with the "It is only available on the local network" documentation. NOTE: manually editing /etc/upnp.json provides a partial but undocumented workaround.

CVSS v3 7.3 HIGH
CVSS v2.0 7.5 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://kn100.me/terramaster-nas-exposing-itself-over-upnp/	Exploit Third Party Advisory
https://news.ycombinator.com/item?id=26681984	Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:terra-master:f2-210_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:terra-master:f2-210:-:*:*:*:*:*:*:*

History

12 Jul 2022, 17:42

Type	Values Removed	Values Added
CWE	~~CWE-863~~	NVD-CWE-Other

14 Apr 2021, 20:27

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 7.5 v3 : 7.3
References	~~(MISC) https://kn100.me/terramaster-nas-exposing-itself-over-upnp/ -~~	(MISC) https://kn100.me/terramaster-nas-exposing-itself-over-upnp/ - Exploit, Third Party Advisory
References	~~(MISC) https://news.ycombinator.com/item?id=26681984 -~~	(MISC) https://news.ycombinator.com/item?id=26681984 - Issue Tracking, Third Party Advisory
CPE		cpe:2.3:o:terra-master:f2-210_firmware:::::::: cpe:2.3:h:terra-master:f2-210:-:::::::*
CWE		CWE-863

03 Apr 2021, 18:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2021-04-03 18:15

Updated : 2023-12-10 13:55

NVD link : CVE-2021-30127

Mitre link : CVE-2021-30127

CVE.ORG link : CVE-2021-30127

JSON object : View

Products Affected

terra-master

f2-210
f2-210_firmware

CWE

NVD-CWE-Other

{"id": "CVE-2021-30127", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}]}, "published": "2021-04-03T18:15:11.983", "references": [{"url": "https://kn100.me/terramaster-nas-exposing-itself-over-upnp/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://news.ycombinator.com/item?id=26681984", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "TerraMaster F2-210 devices through 2021-04-03 use UPnP to make the admin web server accessible over the Internet on TCP port 8181, which is arguably inconsistent with the \"It is only available on the local network\" documentation. NOTE: manually editing /etc/upnp.json provides a partial but undocumented workaround."}, {"lang": "es", "value": "Los dispositivos TerraMaster F2-210 hasta el 03-04-2021 utilizan UPnP para que el servidor web de administraci\u00f3n sea accesible a trav\u00e9s de Internet en el puerto TCP 8181, lo que podr\u00eda ser incoherente con la documentaci\u00f3n \"S\u00f3lo est\u00e1 disponible en la red local\". NOTA: editar manualmente /etc/upnp.json proporciona una soluci\u00f3n parcial pero no documentada"}], "lastModified": "2022-07-12T17:42:04.277", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:terra-master:f2-210_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8D091A66-FAF4-4DBC-8F6A-A063ECE59755", "versionEndIncluding": "2021-04-03"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:terra-master:f2-210:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A084599C-E4D9-4EC5-8103-68CDBB3604CF"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}