CVE-2021-30127
📋 TL;DR
TerraMaster F2-210 NAS devices expose their admin web interface to the internet via UPnP, contrary to documentation stating it's only available locally. This allows remote attackers to potentially access the administrative interface without authentication. All TerraMaster F2-210 users with default UPnP settings are affected.
💻 Affected Systems
- TerraMaster F2-210
📦 What is this software?
F2 210 Firmware by Terra Master
⚠️ Risk & Real-World Impact
Worst Case
Remote attackers gain administrative access to the NAS, potentially compromising all stored data, installing malware, or using the device as an attack vector into the local network.
Likely Case
Unauthorized remote access to the admin interface, allowing configuration changes, data access, or service disruption.
If Mitigated
Limited to local network attacks only, requiring attacker presence on the internal network.
🎯 Exploit Status
Exploitation requires only network access to port 8181. No authentication bypass needed as the interface is directly exposed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
No official patch available. Refer to workarounds section for mitigation steps.
🔧 Temporary Workarounds
Disable UPnP via configuration file
linuxManually edit the UPnP configuration file to prevent automatic port forwarding
ssh into device
edit /etc/upnp.json to disable UPnP functionality
Router-level UPnP blocking
allDisable UPnP on your internet router to prevent automatic port forwarding
🧯 If You Can't Patch
- Disconnect device from internet or place behind firewall blocking port 8181
- Change default admin credentials and implement strong authentication
🔍 How to Verify
Check if Vulnerable:
Check if port 8181 is open to the internet using tools like nmap or online port scanners from outside your networkCheck Version:
Check device firmware version in admin interface or via ssh commandVerify Fix Applied:
Verify port 8181 is no longer accessible from the internet after applying workarounds📡 Detection & Monitoring
Log Indicators:
- Unusual login attempts on port 8181
- Configuration changes from external IPs
Network Indicators:
- External connections to internal port 8181
- UPnP requests opening port 8181
SIEM Query:
source_ip IN external_ips AND dest_port=8181 AND protocol=TCP