Tag

#terramaster

1 post tagged #terramaster.

Analysis · May 20, 2026 · Colten Anderson

A User-Agent string is not authentication, but TerraMaster's NAS treated it like one

To pull the admin password off a TerraMaster NAS, you sent a request with the header User-Agent: TNAS. The API recognized its own app's identifier and handed over the credentials. Chained to a second bug, that's unauthenticated root.