CVE-2021-45841: TerraMaster Tos

High severity, CVSS 8.1. EPSS: 8.4% chance of exploitation in the next 30 days.

In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can self-sign session cookies by knowing the target's MAC address and the user's password hash. Guest users (disabled by default) can be abused using a null/empty hash and allow an unauthenticated attacker to login as guest.

Affected products

• TerraMaster Tos: version 4.2.15-2107141517 only

Published 2022-04-25. Last modified 2026-06-17.