kotsec

I sent an email to that address on the 19th of March. The issue is that millions of passwords per second can be tried against the hash on an average computer and there's no good reason to give the hash out in production.

To anybody owning a Terramaster NAS then i'd advise to set a random password of the maximum length possible.

You should NOT have any terramaster NAS internet facing right now. I disclosed a bug last month to Terramaster that still hasn't been fixed.

Go to http://NAS_IP/module/api.php?wap/ and it will give your admin password out as an md5crypt hash. Why? I assume it's some sort of backdoor/dev code but I don't know.