CVE-2021-30127 Misconfiguration in n/a
TerraMaster NAS devices expose the admin web interface to the internet via UPnP, bypassing local network restrictions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-30127?
CVE-2021-30127 is a high-severity vulnerability in n/a, published on 3 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
TerraMaster F2-210 devices through 2021-04-03 use UPnP to make the admin web server accessible over the Internet on TCP port 8181, which is arguably inconsistent with the "It is only available on the local network" documentation. NOTE: manually editing /etc/upnp.json provides a partial but undocumented workaround.
Which versions are affected by CVE-2021-30127?
It affects 1 product.
Products include Terra-Master F2-210 Firmware.
How do I fix CVE-2021-30127?
No fix has been published for CVE-2021-30127 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-30127 being exploited?
There is no known exploitation of CVE-2021-30127 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-mr2c-pv2q-gwvr.