CVE-2020-28190 : What You Need to Know

TerraMaster TOS <= 4.2.06 checks for updates via an insecure HTTP channel, allowing man-in-the-middle attacks to serve weaponized versions of applications or updates.

Understanding CVE-2020-28190

TerraMaster TOS <= 4.2.06 vulnerability impacting update checks.

What is CVE-2020-28190?

TerraMaster TOS <= 4.2.06 insecurely checks for updates, enabling attackers to intercept requests and distribute malicious updates.

The Impact of CVE-2020-28190

Attackers can exploit the vulnerability to serve weaponized or infected versions of applications or updates.

Technical Details of CVE-2020-28190

Vulnerability details and affected systems.

Vulnerability Description

TerraMaster TOS <= 4.2.06 insecurely checks for updates via HTTP, exposing users to man-in-the-middle attacks.

Affected Systems and Versions

TerraMaster TOS versions up to and including 4.2.06 are impacted.

Exploitation Mechanism

Attackers can intercept update requests over HTTP, allowing them to serve malicious updates.

Mitigation and Prevention

Protective measures against CVE-2020-28190.

Immediate Steps to Take

Disable automatic updates in TerraMaster TOS settings.
Implement HTTPS for update checks to prevent interception.
Regularly monitor for unauthorized updates.

Long-Term Security Practices

Use VPNs or secure networks to prevent man-in-the-middle attacks.
Employ intrusion detection systems to detect malicious activities.

Patching and Updates

Apply patches or updates provided by TerraMaster to secure the update mechanism.