CVE-2021-45837 — AI Deep Analysis Summary

🚨 **Essence**: Remote Code Execution (RCE) in TerraMaster TOS. 📉 **Consequences**: Attackers gain **root** access via a specific endpoint `/tos/index.php?app/del`. 💥 Total system compromise.

🛡️ **Root Cause**: Improper input validation in the `/tos/index.php?app/del` endpoint. ⚠️ Allows injection of special inputs to trigger arbitrary command execution. 🐛 Classic injection flaw.

🏢 **Vendor**: TerraMaster (China). 🖥️ **Product**: TOS (NAS OS). 📦 **Affected Models**: F4-210, F2-210. 📅 **Version**: TOS 4.2.X (specifically 4.2.15-2107141517).

🔓 **Privileges**: Executes commands as **root**. 🗄️ **Data**: Full control over NAS storage. 🕵️ **Action**: Arbitrary code execution. 🌐 Complete takeover of the server.

🔑 **Auth**: Likely requires authentication to access the TOS web interface. 📡 **Config**: Network exposure of the NAS management port increases risk. 📉 Threshold: Medium (needs access to the specific PHP endpoint).

📜 **Public Exp**: Yes. 🔗 **References**: PacketStorm Security & ThatsN0tMy.site posts. 🧪 **PoC**: Available online. 🌍 **Wild Exploitation**: Potential for automated attacks if endpoint is exposed.

🔍 **Check**: Scan for `/tos/index.php?app/del` endpoint. 📊 **Tools**: Use vulnerability scanners targeting TerraMaster TOS. 👀 **Visual**: Look for TOS 4.2.x versions in network inventory.

🛠️ **Patch**: Official fix status not explicitly detailed in data. ⚠️ **Action**: Check TerraMaster support site for updates. 🔄 **Mitigation**: Apply vendor patches immediately if available.

🚧 **Workaround**: Block external access to the management interface. 🚫 **Firewall**: Restrict `/tos/index.php` access to trusted IPs only. 🛑 **Disable**: If possible, disable unnecessary web services.

🔥 **Priority**: **CRITICAL**. 🚨 **Urgency**: High. 💣 **Reason**: Root-level RCE with public PoCs. 🏃 **Action**: Patch or isolate immediately. ⏳ Time is of the essence.