CVE-2021-30127

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

TerraMaster F2-210 devices through 2021-04-03 use UPnP to make the admin web server accessible over the Internet on TCP port 8181, which is arguably inconsistent with the "It is only available on the local network" documentation. NOTE: manually editing /etc/upnp.json provides a partial but undocumented workaround.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://kn100.me/terramaster-nas-exposing-itself-over-upnp/Exploit, Third Party Advisory
https://news.ycombinator.com/item?id=26681984Issue Tracking, Third Party Advisory
https://kn100.me/terramaster-nas-exposing-itself-over-upnp/Exploit, Third Party Advisory
https://news.ycombinator.com/item?id=26681984Issue Tracking, Third Party Advisory

Timeline

Published: Apr 3, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-301289.8Apache OFBiz has unsafe deserialization prior to 17.12.07 version CVE-2021-301296.5A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects CVE-2021-30139.8ripgrep before 13 on Windows allows attackers to trigger execution of arbitrary programs from the current working directory via the -z/--sea CVE-2021-301307.5phpseclib before 2.0.31 and 3.x before 3.0.7 mishandles RSA PKCS#1 v1.5 signature verification.CVE-2021-301329.8Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges.CVE-2021-301336.1A cross-site scripting (XSS) vulnerability in CloverDX Server 5.9.0, CloverDX 5.8.1, CloverDX 5.7.0, and earlier allows remote attackers to CVE-2021-301346.1php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post_file_path_upload.php key parameter and the POST data CVE-2021-301378.2Assyst 10 SP7.5 has authenticated XXE leading to SSRF via XML unmarshalling. The application allows users to send JSON or XML data to the se CVE-2021-301397.5In Alpine Linux apk-tools before 2.12.5, the tarball parser allows a buffer overflow and crash.CVE-2021-30146.1In MikroTik RouterOS through 2021-01-04, the hotspot login page is vulnerable to reflected XSS via the target parameter.CVE-2021-301405.4LiquidFiles 3.4.15 has stored XSS through the "send email" functionality when sending a file via email to an administrator. When a file has CVE-2021-301417.5Module/Settings/UserExport.php in Friendica through 2021.01 allows settings/userexport to be used by anonymous users, as demonstrated by an