CVE-2021-45839

MEDIUM

TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting.

Title source: github.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-45839 has a selected CVSS score of 6.5 (medium); EIP currently links 1 catalogued exploit.

Description

It is possible to obtain the first administrator's hash set up on the system in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) as well as other information such as MAC address, internal IP address etc. by performing a request to the /module/api.php?mobile/webNasIPS endpoint.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

Proofs of concept

1

Catalogued exploits

MetasploitTerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting.Metasploit exploitby h00die-gr3y <h00die.gr3y@gmail.com> +1 moreNot analyzed1 file

Ruby · linked to 3 vulnerabilities

Metasploit
PoC details

References

3