cbcvebase.
CVE-2021-45841
published 2022-04-25

CVE-2021-45841: In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can self-sign session cookies by knowing the target's MAC address and the user's…

PriorityP262high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EXPLOIT
EPSS
8.06%
94.1th percentile
In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can self-sign session cookies by knowing the target's MAC address and the user's password hash. Guest users (disabled by default) can be abused using a null/empty hash and allow an unauthenticated attacker to login as guest.

Affected

1 ranges
VendorProductVersion rangeFixed in
terra-mastertos——

Detection & IOCsextracted from sources · hover to see the quote

url/module/api.php?mobile/webNasIPS↗
url/tos/index.php?app/del↗
  • →Monitor for unauthenticated or anomalous requests to /module/api.php?mobile/webNasIPS, which is abused to harvest the administrator password hash and MAC address for session crafting. ↗
  • →Detect self-signed/forged session cookies on TerraMaster TOS devices; cookies are crafted using the target MAC address and user password hash, enabling privilege escalation without valid credentials. ↗
  • →Alert on guest account login activity on TerraMaster TOS; guest sessions can be forged using a null/empty password hash, enabling unauthenticated access even when the guest account appears disabled. ↗
  • →Monitor for POST/GET requests to /tos/index.php?app/del with crafted or unexpected input, as this endpoint is used for root-level RCE in the exploit chain following session forgery. ↗
  • ·Guest user account is disabled by default on TerraMaster TOS; however, if enabled, it can be exploited with a null/empty hash for unauthenticated login. Verify guest account is disabled and audit account configurations. ↗
  • ·The full exploit chain (CVE-2021-45839 → CVE-2021-45841 → CVE-2021-45837) affects TerraMaster TOS versions 4.2.15 and below; patching to a version above 4.2.15 is required to break the chain. ↗

CVSS provenance

nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.