Terra Master manufactures a family of network-attached storage and backup appliances, primarily through its TerraOS operating system and dedicated NAS models such as the F2-210, F4-210, and FS-210 lines. The vendor's vulnerability footprint remains modest relative to its deployment scale, reflecting the narrower attack surface of specialized storage appliances compared to general-purpose server platforms. Although Terra Master's disclosure history is limited, defenders should track updates for these devices as they often operate in long-lived deployments where firmware patching cycles lag significantly behind release. Current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Terra Master over time
Signals from CVEs in this vendor scope (47 CVEs).
47 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-24990HIGH TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading | Feb 7, 2023 | 7.5 | 97 | YES | YES |
CVE-2020-28188CRITICAL Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php in Event parameter. | Dec 24, 2020 | 9.8 | 91 | NO | YES |
CVE-2020-35665CRITICAL An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter in include/makecvs.php during CSV creati | Dec 23, 2020 | 9.8 | 86 | NO | YES |
CVE-2022-24989CRITICAL TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php? | Aug 20, 2023 | 9.8 | 58 | NO | YES |
CVE-2020-15568CRITICAL TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php | Jan 30, 2021 | 9.8 | 57 | NO | YES |
CVE-2018-13354CRITICAL System command injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "Event" parameter. | Nov 27, 2018 | 9.8 | 43 | NO | NO |
CVE-2021-45837CRITICAL It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by sending a specifically crafted input to /tos/index.php?app/del. | Apr 25, 2022 | 9.8 | 42 | NO | YES |
CVE-2021-45841HIGH In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can self-sign session cookies by knowing the target's MAC address and the user's password hash. Guest users | Apr 25, 2022 | 8.1 | 40 | NO | YES |
CVE-2018-13358HIGH System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "checkName" parameter. | Nov 27, 2018 | 8.8 | 39 | NO | NO |
CVE-2018-13350CRITICAL SQL injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute SQL queries via the "Event" parameter. | Nov 27, 2018 | 9.8 | 37 | NO | NO |
Signals from CVEs in this vendor scope (47 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Terra Master.
Media articles that mention a CVE ID that affects a product developed by Terra Master — matched by CVE ID, not by vendor name.