tag
Nas
ZimaOS Arbitrary File Write via Unvalidated File API Path — CVE-2026-28286
ZimaOS exposes a file-management REST API endpoint (/v21/files/file) that accepts a user-supplied file path without canonicalizing it or restricting it to a base directory. Because this is a web-facing REST API rather than a local system call, an attacker…
ASUSTOR ADM vpnupload.cgi Format String / Stack Buffer Overflow RCE — CVE-2026-6643
The ASUSTOR ADM NAS operating system's WireGuard config upload handler (vpnupload.cgi, uploadwireguard action) contains two chained memory-safety bugs. First, it JSON-encodes the parsed config and passes the result directly as the format string to printf(),…
TossUp — TerraMaster TOS Unauthenticated Redis Root RCE + NFS LPE
TossUp is a pair of bugs against TerraMaster TOS NAS devices. The primary issue is that Redis 4.0.10 runs as root and listens on 0.0.0.0:6379 with no authentication — despite /etc/redis.conf containing bind 127.0.0.1, the init script starts Redis as…