CVE-2020-28188

PoC ×2—

CVSS 3.1

9.8 critical

EPSS

97%p100

Published

Dec 24, 2020 (Dec 24, 2020)

Modified

Jun 17, 2026

Description

Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php in Event parameter.

Vendors: terra-master
Products: tos
Weakness: CWE-78
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (96.6%)

In the news7 stories

Network Attack Trends: Internet of Threats (November 2020

Palo Alto Unit 42Jun 6, 13:24 UTC · Jun 6, 2024Exploit / PoC in the wildCVE-2020-28188 CVE-2020-17519 CVE-2020-29227+62 CVEs

Attackers Are Taking Advantage of the Open-Source Service Interactsh for Malicious Purposes

Palo Alto Unit 42Jun 6, 01:14 UTC · Jun 6, 2024Exploit / PoC CVE-2017-9506 CVE-2017-12629 CVE-2019-2767+23 CVEs

CVE-2020-28188

In the news7 stories

Network Attack Trends: Internet of Threats (November 2020

Attackers Are Taking Advantage of the Open-Source Service Interactsh for Malicious Purposes

CISA Warns of Actively Exploited Apache Flink Security Vulnerability

Necro botnet now targets Visual Tools DVRs

Threat actors are attempting to exploit the CVE-2021-22986 flaw in F5 BIG

FreakOut! Ongoing Botnet Attack Exploiting Recent Linux Vulnerabilities

FreakOut botnet target 3 recent flaws to compromise Linux devices