PT-2021-18618 · Terramaster · Terramaster F2-210

Kotsecon · Published 2021-04-03 · Updated 2022-07-12 · CVE-2021-30127

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TerraMaster F2-210 devices through 2021-04-03

Description The issue concerns TerraMaster F2-210 devices making the admin web server accessible over the Internet on TCP port 8181 via UPnP, contrary to the documentation stating it is only available on the local network.

Recommendations For TerraMaster F2-210 devices through 2021-04-03, consider manually editing /etc/upnp.json as a partial workaround, though it is undocumented.

Exploit

Fix

Related Identifiers

CVE-2021-30127

Affected Products

Terramaster F2-210

References · 5

• 🔥 https://kn100.me/terramaster-nas-exposing-itself-over-upnp · Exploit
• https://osv.dev/vulnerability/CVE-2021-30127 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-30127 · Security Note
• https://t.me/cvenotify/12573 · Telegram Post
• https://news.ycombinator.com/item?id=26681984 · Note