thecus vulnerabilities

Products

• n8800 nas server 3
• n8800 nas server firmware 3
• n4800eco firmware 1
• n5200pro nas server control panel 1
• Thecus N4800Eco Nas Server Control Panel 1

Latest thecus CVEs

Newest publication first

1. CVE-2021-47816 Thecus N4800Eco Nas Server Control Panel - Command Injection

   Published 2026-01-16

   Medium·CVSS 5.3

   Thecus N4800Eco NAS Server Control Panel contains a command injection vulnerability that allows authenticated attackers to execute arbitrary system commands through user management endpoints. Attackers can inject commands via username and batch user creation parameters to execute...

2. CVE-2021-34111 Thecus 4800Eco was discovered to contain a command injection vulnerability via the username parameter in /adm/setmain.php.

   Published 2022-05-20

   Critical·CVSS 9.8

   Thecus 4800Eco was discovered to contain a command injection vulnerability via the username parameter in /adm/setmain.php.

3. CVE-2013-5669 The Thecus NAS server N8800 with firmware 5.03.01 uses cleartext credentials for administrative authentication, which allows remote attackers to obtain sensitive information by sniffing the network.

   Published 2014-01-24

   High·CVSS 7.8

   The Thecus NAS server N8800 with firmware 5.03.01 uses cleartext credentials for administrative authentication, which allows remote attackers to obtain sensitive information by sniffing the network.

4. CVE-2013-5668 The ADS/NT Support page on the Thecus NAS server N8800 with firmware 5.03.01 allows remote attackers to discover the administrator credentials by reading this page's cleartext content.

   Published 2014-01-24

   High·CVSS 7.8

   The ADS/NT Support page on the Thecus NAS server N8800 with firmware 5.03.01 allows remote attackers to discover the administrator credentials by reading this page's cleartext content.

5. CVE-2013-5667 The Thecus NAS server N8800 with firmware 5.03.01 allows remote attackers to execute arbitrary commands via a get_userid action with shell metacharacters in the username parameter.

   Published 2014-01-24

   High·CVSS 10.0

   The Thecus NAS server N8800 with firmware 5.03.01 allows remote attackers to execute arbitrary commands via a get_userid action with shell metacharacters in the username parameter.

6. CVE-2008-0804 PHP remote file inclusion vulnerability in usrgetform.html in Thecus N5200Pro NAS Server allows remote attackers to execute arbitrary PHP code via a URL in the name parameter.

   Published 2008-02-18

   Medium·CVSS 6.8 EPSS 2.0%

   PHP remote file inclusion vulnerability in usrgetform.html in Thecus N5200Pro NAS Server allows remote attackers to execute arbitrary PHP code via a URL in the name parameter.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.