CVE-2021-45841
Published: 25 April 2022
Summary
CVE-2021-45841 is a high-severity Improper Authentication (CWE-287) vulnerability in Terra-Master Tos. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 1.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-32559
Vulnerability details
In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can self-sign session cookies by knowing the target's MAC address and the user's password hash. Guest users (disabled by default) can be abused using a null/empty hash and allow an unauthenticated…
more
attacker to login as guest.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Detects unauthorized successful logons resulting from improper authentication implementations.
Training on authentication mechanisms and best practices decreases the occurrence of improper authentication.
Documented IA policy and procedures require proper authentication mechanisms to be defined and followed, reducing improper authentication.
Identity providers centralize and enforce authentication mechanisms, reducing improper authentication.
Central credential stores and rotation policies remove the need for hard-coded credentials in configuration files or code.
Hunting detects anomalous authentication patterns or successful bypasses that allow persistent unauthorized entry.
Requiring explicit security roles and risk integration in the SDLC forces authentication mechanisms to be planned, documented, and validated instead of omitted or weakly implemented.
Documented procedures ensure personnel are trained on authentication mechanisms, tangibly lowering the risk of improper authentication being exploited.