CVE-2021-45837

CRITICAL EXPLOITED IN THE WILD

TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting.

Title source: metasploit
STIX 2.1

Exploitation Summary

CVE-2021-45837 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). EIP tracks 1 public exploit, including a Metasploit module exploits/linux/http/terramaster_unauth_rce_cve_2021_45837.

AI-analyzed exploit summary This Metasploit module exploits a chain of vulnerabilities (CVE-2021-45837, CVE-2021-45839, CVE-2021-45841) in TerraMaster TOS 4.2.15 or lower to achieve unauthenticated remote code execution as root. It leverages session crafting and command injection via the `/tos/index.php?app/del` endpoint.

Description

It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by sending a specifically crafted input to /tos/index.php?app/del.

Exploits (1)

metasploit WORKING POC EXCELLENT
rubypocunix
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/terramaster_unauth_rce_cve_2021_45837.rb

This Metasploit module exploits a chain of vulnerabilities (CVE-2021-45837, CVE-2021-45839, CVE-2021-45841) in TerraMaster TOS 4.2.15 or lower to achieve unauthenticated remote code execution as root. It leverages session crafting and command injection via the `/tos/index.php?app/del` endpoint.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: TerraMaster TOS <= 4.2.15
No auth needed
Prerequisites: Network access to the target device · TOS version <= 4.2.15
devstral-2 · analyzed Apr 23, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.8108
EPSS Percentile 99.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2024-07-25
InTheWild.io 2022-05-01
Status published
Products (1)
terra-master/tos 4.2.15-2107141517
Published Apr 25, 2022
Tracked Since Feb 18, 2026