Login Sign Up

CVE-2021-45837

9.8 CRITICAL
Remote Code Execution

📋 TL;DR

This vulnerability allows remote attackers to execute arbitrary commands with root privileges on affected TerraMaster NAS devices. Attackers can exploit this by sending specially crafted input to the /tos/index.php?app/del endpoint. This affects TerraMaster F4-210 and F2-210 devices running TOS 4.2.X versions.

💻 Affected Systems

Products:
  • TerraMaster F4-210
  • TerraMaster F2-210
Versions: TOS 4.2.X up to 4.2.15-2107141517
Operating Systems: TerraMaster TOS
Default Config Vulnerable: ⚠️ Yes
Notes: All default configurations are vulnerable. No special configuration required for exploitation.

📦 What is this software?

Tos by Terra Master

View all CVEs affecting Tos →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise with root access, allowing data theft, ransomware deployment, or device takeover as part of a botnet.

🟠

Likely Case

Remote code execution leading to data exfiltration, lateral movement within networks, or cryptomining malware installation.

🟢

If Mitigated

Limited impact if devices are isolated behind firewalls with strict network controls and regular monitoring.

🌐 Internet-Facing: HIGH - Directly exploitable via web interface without authentication.
🏢 Internal Only: HIGH - Can be exploited from any network segment with access to the device's web interface.

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: CONFIRMED
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Exploit code is publicly available and requires minimal technical skill to execute.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: TOS 4.2.16 or later

Vendor Advisory: https://www.terra-master.com/global/

Restart Required: Yes

Instructions:

1. Log into TerraMaster TOS web interface. 2. Navigate to Control Panel > General Settings > Update & Restore. 3. Check for updates and install TOS 4.2.16 or later. 4. Reboot the device after update completes.

🔧 Temporary Workarounds

Block vulnerable endpoint

linux

Use web application firewall or reverse proxy to block access to /tos/index.php?app/del

# Example nginx location block
location = /tos/index.php?app/del { deny all; }

Network segmentation

linux

Isolate TerraMaster devices from internet and restrict internal network access

# Example iptables rule
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP

🧯 If You Can't Patch

  • Immediately disconnect affected devices from internet and restrict network access to trusted IPs only
  • Implement strict monitoring for suspicious activity on device web interface and system logs

🔍 How to Verify

Check if Vulnerable:

Check TOS version in web interface under Control Panel > General Settings > Update & Restore. If version is 4.2.15-2107141517 or earlier 4.2.X, device is vulnerable.

Check Version:

curl -s http://[device-ip]/tos/ | grep -i version

Verify Fix Applied:

Verify TOS version is 4.2.16 or later. Test by attempting to access /tos/index.php?app/del - should return error or be blocked.

📡 Detection & Monitoring

Log Indicators:

  • HTTP requests to /tos/index.php?app/del with unusual parameters
  • Sudden root privilege escalation in system logs
  • Unusual process execution from web server context

Network Indicators:

  • HTTP POST requests to /tos/index.php?app/del with command injection patterns
  • Outbound connections from NAS device to unusual destinations

SIEM Query:

source="web_access.log" AND uri="/tos/index.php?app/del" AND (param="cmd" OR param="command" OR param="exec")

📊 Metadata

CVE ID: CVE-2021-45837
CVSS v3 Score: 9.8 (CRITICAL)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: April 25, 2022
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON