KnowSafe 安全预警：TerraMaster TOS path 远程代码执行漏洞

KnowSafe 安全预警：KnowSafe 安全团队监测到编号 AVD-2020-28188 的安全漏洞（危害等级：高危）已公开披露，相关用户应尽快排查并完成修复。

漏洞介绍

Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php in Event parameter.

影响范围

系统：terra-master tos（影响面 Up to (including) 4.2.06）

解决方案

安装官方补丁

参考信息

http://packetstormsecurity.com/files/172880/TerraMaster-TOS-4.2.06-Remote-Code-Execution.html

https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/

https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/

https://www.terra-master.com/

KnowSafe 将持续跟踪该漏洞的利用情况与修复进展，如需漏洞管理与应急响应支持，欢迎联系 KnowSafe 安全团队。