CVE-2020-35665
82Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 78%
from disclosure to weapon602 days
Published on NVDDec 23
1st PoC+602d
metasploitDec 12
VulnCheck+22d
exploitation probability
78%top 1% of all CVEs
observed exploitation
yesVulnCheck
3 public exploit(s)
An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter in include/makecvs.php during CSV creation.
Affected products
n/a · n/apublic PoCs found — 3
cve_referencewww.exploit-db.com/exploits/49330unverifiedvulncheckvulncheck.com/xdb/5b4dae190d2bunverifiedcve_referencepacketstormsecurity.com/files/172880/TerraMaster-TOS-4.2.06-Remote-Code-Execution.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.