EIP-2026-112602

PRE-CVE

Terramaster TOS 4.2.15 - Remote Code Execution (RCE) (Unauthenticated)

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-112602. PoCs published by n0tme.

AI-analyzed exploit summary This exploit targets Terramaster TOS 4.2.X (4.2.15-2107141517) and achieves unauthenticated remote code execution (RCE) via multiple injection points in the web interface. It also includes functionality to create admin users and download files.

Description

Terramaster TOS 4.2.15 - Remote Code Execution (RCE) (Unauthenticated)

Exploits (1)

exploitdb WORKING POC
by n0tme · pythonwebappsphp
https://www.exploit-db.com/exploits/50635

This exploit targets Terramaster TOS 4.2.X (4.2.15-2107141517) and achieves unauthenticated remote code execution (RCE) via multiple injection points in the web interface. It also includes functionality to create admin users and download files.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Terramaster TOS 4.2.X (4.2.15-2107141517)
No auth needed
Prerequisites: Network access to the target · Terramaster TOS 4.2.X running on the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026