PT-2024-25958 · Terramaster · Terramaster Tos

Shinnai · Published 2024-06-14 · Updated 2024-07-03 · CVE-2024-34539

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions TerraMaster TOS firmware versions through 5.1

Description The issue concerns hardcoded credentials in the firmware, allowing a remote attacker to login to the mail or webmail server. These credentials can also be used to access the administration panel and perform privileged actions.

Recommendations For TerraMaster TOS firmware versions through 5.1, update to a version that removes the hardcoded credentials to prevent unauthorized access. As a temporary workaround, consider restricting access to the administration panel and mail or webmail servers to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-259

Related Identifiers

CVE-2024-34539

Affected Products

Terramaster Tos

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-34539 · Security Note
• https://shinnai.altervista.org/exploits/SH-20240611-CVE-2024-34539.html · Note
• https://twitter.com/CVEnew/status/1801673823282204947 · Twitter Post