Описание
In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can self-sign session cookies by knowing the target's MAC address and the user's password hash. Guest users (disabled by default) can be abused using a null/empty hash and allow an unauthenticated attacker to login as guest.
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1
Одновременно
cpe:2.3:o:terra-master:tos:4.2.15-2107141517:*:*:*:*:*:*:*
Одно из
cpe:2.3:h:terra-master:f2-210:-:*:*:*:*:*:*:*
cpe:2.3:h:terra-master:f4-210:-:*:*:*:*:*:*:*
EPSS
Процентиль: 98%
0.65511
Средний
8.1 High
CVSS3
6.8 Medium
CVSS2
Дефекты
CWE-287
Связанные уязвимости
CVSS3: 8.1
github
почти 4 года назад
In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can self-sign session cookies by knowing the target's MAC address and the user's password hash. Guest users (disabled by default) can be abused using a null/empty hash and allow an unauthenticated attacker to login as guest.
EPSS
Процентиль: 98%
0.65511
Средний
8.1 High
CVSS3
6.8 Medium
CVSS2
Дефекты
CWE-287