CVE-2020-35665: TerraMaster TOS unauthenticated OS command injection in CSV creation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote command execution with a 9.8 CVSS score, public exploit code, and very high EPSS probability makes this an urgent patch-or-isolate case.

What it is

TerraMaster TOS through 4.2.06 passes the Event parameter in include/makecvs.php to a shell without sanitization during CSV creation, allowing OS command injection. Because the endpoint is reachable without authentication, any network attacker who can reach the device can execute commands as the web service user.

Impact

An attacker gains arbitrary command execution on the NAS with the privileges of the TOS web service, enabling data theft, persistence, or use of the device as a foothold into the network.

Attack surface

Reached over the network via HTTP requests to include/makecvs.php with crafted shell metacharacters in the Event parameter; no authentication and no user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV, but public exploit code exists (Exploit-DB 49330, Packet Storm, pentest.com.tr) and EPSS is 0.7848 (99.56th percentile), indicating high likelihood of exploitation.

What to do

• Upgrade TerraMaster TOS to a version later than 4.2.06; if no fixed release is available, isolate the device.
• Block or restrict external and untrusted network access to the TOS web interface, especially include/makecvs.php.
• Place the NAS behind a firewall or VPN and remove any direct internet exposure.
• Audit the TOS web service account for unexpected files, processes, or scheduled tasks and rotate credentials.
• Monitor vendor advisories for a confirmed patched version since the record does not name one.

Detection

• Inspect web server logs for requests to include/makecvs.php containing shell metacharacters (;, |, $(), backticks) in the Event parameter.
• Alert on unexpected child processes spawned by the TOS web service (for example shell, wget, curl, nc).
• Monitor for outbound connections from the NAS to unfamiliar hosts that could indicate command-and-control or payload retrieval.
• Review file integrity of TOS web files and watch for new scripts or cron entries created after suspicious requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.