Vulnerability Details CVE-2020-35665
An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter in include/makecvs.php during CSV creation.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.894
EPSS Ranking 99.5%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 10.0
References
- http://packetstormsecurity.com/files/172880/TerraMaster-TOS-4.2.06-Remote-Code-Execution.html
- https://www.exploit-db.com/exploits/49330
- https://www.pentest.com.tr/exploits/TerraMaster-TOS-4-2-06-Unauthenticated-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/172880/TerraMaster-TOS-4.2.06-Remote-Code-Execution.html
- https://www.exploit-db.com/exploits/49330
- https://www.pentest.com.tr/exploits/TerraMaster-TOS-4-2-06-Unauthenticated-Remote-Code-Execution.html
Products affected by CVE-2020-35665
-
cpe:2.3:o:terra-master:terramaster_operating_system:-
-
cpe:2.3:o:terra-master:terramaster_operating_system:3.0.33
-
cpe:2.3:o:terra-master:terramaster_operating_system:3.1.03
-
cpe:2.3:o:terra-master:terramaster_operating_system:4.2.06