N0Tme

**Name of the Vulnerable Software and Affected Versions** Terramaster F4-210, F2-210 TOS version 4.2.15-2107141517 **Description** An authenticated attacker can execute arbitrary commands as root by injecting a maliciously crafted input in the request through the "/tos/index.php?app/hand app" API endpoint. **Recommendations** For Terramaster F4-210, F2-210 TOS version 4.2.15-2107141517, consider restricting access to the "/tos/index.php?app/hand app" API endpoint until a patch is available. As a temporary workaround, avoid using this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Terramaster F4-210, F2-210 TOS version 4.2.X (4.2.15-2107141517) **Description** The issue allows for the execution of arbitrary commands as root by sending a specifically crafted input to the "/tos/index.php?app/del" API endpoint. **Recommendations** For Terramaster F4-210, F2-210 TOS version 4.2.X (4.2.15-2107141517), as a temporary workaround, consider restricting access to the "/tos/index.php?app/del" API endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Terramaster F4-210, F2-210 TOS version 4.2.X (4.2.15-2107141517) **Description** The issue allows an attacker to obtain sensitive information, including the first administrator's hash, MAC address, and internal IP address, by sending a request to the "module/api.php?mobile/webNasIPS" endpoint. **Recommendations** For Terramaster F4-210, F2-210 TOS version 4.2.X (4.2.15-2107141517), consider restricting access to the "module/api.php?mobile/webNasIPS" endpoint until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Terramaster F4-210, F2-210 TOS version 4.2.X (4.2.15-2107141517) **Description** The issue allows for the execution of arbitrary commands as root by sending specifically crafted input to the "/tos/index.php?app/app start stop" API endpoint. **Recommendations** For Terramaster F4-210, F2-210 TOS version 4.2.X (4.2.15-2107141517), as a temporary workaround, consider restricting access to the "/tos/index.php?app/app start stop" API endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Terramaster F4-210, F2-210 TOS versions 4.2.X (4.2.15-2107141517) **Description** The issue allows an attacker to self-sign session cookies if they know the target's MAC address and the user's password hash. Additionally, guest users, which are disabled by default, can be exploited using a null or empty hash, enabling an unauthenticated attacker to log in as a guest. **Recommendations** For Terramaster F4-210, F2-210 TOS version 4.2.15-2107141517, consider disabling guest user accounts to prevent exploitation. As a temporary workaround, restrict access to the login functionality until a patch is available. Avoid using null or empty hashes for guest users to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Terramaster F4-210, F2-210 TOS versions 4.2.15-2107141517 **Description** The issue allows an attacker to obtain sensitive information, including the first administrator's hash, MAC address, and internal IP address, by sending a request to the "/module/api.php?mobile/wapNasIPS" endpoint. **Recommendations** For Terramaster F4-210, F2-210 TOS versions 4.2.15-2107141517, as a temporary workaround, consider restricting access to the "/module/api.php?mobile/wapNasIPS" endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.