CVE-2021-45836

Опубликовано: 25 апр. 2022

Источник: nvd

CVSS3: 8.8

CVSS2: 9

EPSS Низкий

Описание

An authenticated attacker can execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by injecting a maliciously crafted input in the request through /tos/index.php?app/hand_app.

Ссылки

https://thatsn0tmy.site/posts/2021/12/how-to-summon-rces/
Exploit
Third Party Advisory
https://thatsn0tmy.site/posts/2021/12/how-to-summon-rces/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:terra-master:tos:4.2.15-2107141517:*:*:*:*:*:*:*

Одно из

cpe:2.3:h:terra-master:f2-210:-:*:*:*:*:*:*:*

cpe:2.3:h:terra-master:f4-210:-:*:*:*:*:*:*:*

EPSS

Процентиль: 72%

0.00716

Низкий

8.8 High

CVSS3

9 Critical

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

GHSA-g2h5-m8r4-v3h9