In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can self-sign session cookies by knowing the target's MAC address and the user's password hash. Guest users (disabled by default) can be abused using a null/empty hash and allow an unauthenticated attacker to login as guest.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/172881/TerraMaster-TOS-4.2.15-Remote-Code-Execution.html | |
| https://thatsn0tmy.site/posts/2021/12/how-to-summon-rces/ | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
08 Aug 2023, 14:22
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-798 CWE-287 |
12 Jun 2023, 07:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
05 May 2022, 17:08
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Terra-master tos
Terra-master f4-210 Terra-master Terra-master f2-210 |
|
| CVSS |
v2 : v3 : |
v2 : 6.8
v3 : 8.1 |
| CPE | cpe:2.3:o:terra-master:tos:4.2.15-2107141517:*:*:*:*:*:*:* cpe:2.3:h:terra-master:f4-210:-:*:*:*:*:*:*:* cpe:2.3:h:terra-master:f2-210:-:*:*:*:*:*:*:* |
|
| CWE | NVD-CWE-noinfo | |
| References | (MISC) https://thatsn0tmy.site/posts/2021/12/how-to-summon-rces/ - Exploit, Third Party Advisory |
25 Apr 2022, 11:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-04-25 11:15
Updated : 2023-12-10 14:22
NVD link : CVE-2021-45841
Mitre link : CVE-2021-45841
CVE.ORG link : CVE-2021-45841
JSON object : View
Products Affected
terra-master
- tos
- f4-210
- f2-210