Paper/Archive/CVE-2024-34539

CVE-2024-34539

terra-master tos — Hardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail or webmail server.

EPSS 0.5%public exploit CVSS 9.4

critical.is priorityof 100

CVSS 9.4 (ADP)9.4 / 10 × 3028.2 Not in CISA KEV+300.0 EPSS percentile 44.0.440 × 208.8 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

Hardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail or webmail server. These credentials can also be used to login to the administration panel and to perform privileged actions.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

tos≤ 5.1–CISA-ADP

Scores by source

CISA ADP9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refshinnai.altervista.org/exploits/SH-20240611-CVE-2024-34539.html