n0tme

4 exploits Active since Apr 2022
CVE-2021-45841 METASPLOIT HIGH ruby WORKING POC
Terramaster F4-210, F2-210 TOS 4.2.X - Info Disclosure
In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can self-sign session cookies by knowing the target's MAC address and the user's password hash. Guest users (disabled by default) can be abused using a null/empty hash and allow an unauthenticated attacker to login as guest.
CVSS 8.1
CVE-2021-45837 METASPLOIT CRITICAL ruby WORKING POC
TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting.
It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by sending a specifically crafted input to /tos/index.php?app/del.
CVSS 9.8
CVE-2021-45839 METASPLOIT MEDIUM ruby WORKING POC
Terramaster F4-210,F2-210 TOS 4.2.X - Info Disclosure
It is possible to obtain the first administrator's hash set up on the system in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) as well as other information such as MAC address, internal IP address etc. by performing a request to the /module/api.php?mobile/webNasIPS endpoint.
CVSS 6.5
EIP-2026-112602 EXPLOITDB python WORKING POC
Terramaster TOS 4.2.15 - Remote Code Execution (RCE) (Unauthenticated)