Vulnerabilities

TI-2021-22432 CVE-2021-47816 · GHSA-6qxr-24qm-qr24

Thecus N4800Eco Nas Server Control Panel - Command Injection

MEDIUM 59

Thecus N4800Eco NAS Server Control Panel contains a command injection vulnerability that allows authenticated attackers to execute arbitrary system commands through user management endpoints.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.01805 Published 2026-01-16 No fix listed CWE-78

TI-2021-13275 CVE-2021-34111 · GHSA-7j2p-qr4g-pg5x

Thecus 4800Eco was discovered to contain a command injection vulnerability via the…

MEDIUM 47

Thecus 4800Eco was discovered to contain a command injection vulnerability via the username parameter in /adm/setmain.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02628 Published 2022-05-20 No fix listed CWE-78

TI-2013-04834 CVE-2013-5669 · GHSA-hf4c-4564-9cc8

The Thecus NAS server N8800 with firmware 5.03.01 uses cleartext credentials for…

LOW 38

The Thecus NAS server N8800 with firmware 5.03.01 uses cleartext credentials for administrative authentication, which allows remote attackers to obtain sensitive information by sniffing the network.

CVSS 2.0HIGH 7.8 Network No auth Interaction — EPSS 0.02196 Published 2014-01-24 No fix listed CWE-255

TI-2013-04833 CVE-2013-5668 · GHSA-f5wm-62rm-wmhq

The ADS/NT Support page on the Thecus NAS server N8800 with firmware 5.03.01 allows…

LOW 38

The ADS/NT Support page on the Thecus NAS server N8800 with firmware 5.03.01 allows remote attackers to discover the administrator credentials by reading this page's cleartext content.

CVSS 2.0HIGH 7.8 Network No auth Interaction — EPSS 0.02067 Published 2014-01-24 No fix listed CWE-255

TI-2013-04832 CVE-2013-5667 · GHSA-85fw-hhrw-fr33

The Thecus NAS server N8800 with firmware 5.03.01 allows remote attackers to execute…

MEDIUM 50

The Thecus NAS server N8800 with firmware 5.03.01 allows remote attackers to execute arbitrary commands via a get_userid action with shell metacharacters in the username parameter.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.04159 Published 2014-01-24 No fix listed CWE-78

TI-2008-00770 CVE-2008-0804 · GHSA-x995-j3jg-4xpc

PHP remote file inclusion vulnerability in usrgetform.html in Thecus N5200Pro NAS Server…

LOW 34

PHP remote file inclusion vulnerability in usrgetform.html in Thecus N5200Pro NAS Server allows remote attackers to execute arbitrary PHP code via a URL in the name parameter.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01975 Published 2008-02-18 No fix listed CWE-94