| TerraMaster F4-424
|
|
Security Grade
Calculator v
|
TerraMaster F4-424 4-Bay NAS
Release Date: 2023-12-10 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
[[1] 🔗 Proof]
|
Rare is an assessor judgment because exploitation requires physical access; it is not a measured frequency. The official guide identifies the F4-424 reset button inside the side cover. Accessible power, network/USB interfaces and removable drives also permit interruption, part removal or reset. Physical protection cannot be inferred from an absence of incident reports.
|
| Known vulnerabilities
|
Rare
|
[[2] 🔗 Proof]
|
A reproduced vendor advisory dated 2025-06-30 reports unauthorized-access risk in password-free sharing on TOS 5.x/6.x. Rare means an isolated reviewed disclosure, not a measured low probability. Password-free links are excluded from the assessed profile.
|
| Prior attacks
|
None
|
[[3] 🔗 Proof]
|
Focused model-name searches of vendor security information, NVD/CISA-indexed results and security-research reporting on 2026-10-23 did not identify a qualifying model-specific published incident. None means none identified in this review, not immunity or proof of zero incidents. Older TerraMaster-family ransomware cases do not establish compromise of this F4-424 model.
|
| Updatability
|
Very common
|
[[4] 🔗 Proof]
|
Recurring TOS releases are documented: 6.0.694 on 2025-05-26, 6.0.783 on 2025-09-22 and its November patch. This qualitative frequency assessment does not assume updates installed automatically.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
[[5] 🔗 Proof]
|
Named users authenticate NAS access, while optional guest SMB and other services can allow weaker access. Mutual authentication is not universal.
|
| Communications
|
No encryption
|
[[6] 🔗 Proof]
|
Reference configuration follows the documented HTTP local-management path at http://tnas.local. HTTPS with certificates is available separately, but this HTTP connection is not transport-encrypted.
|
| Storage
|
No encryption
|
[[7] 🔗 Proof]
|
Ordinary shared folder with Encrypt this shared folder unchecked. Optional encrypted folders protect their selected data; boot/system flash encryption is not established.
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Full
|
[[8] 🔗 Proof]
|
TOS6 supports users, groups, per-folder permissions and quotas. The initialization super-administrator cannot be disabled/deleted; ordinary users have separate rights.
|
| Authentication
|
Basic
|
[[9] 🔗 Proof]
|
Baseline named-account/password login; email verification supports recovery and OTP is optional. No claim of comprehensive physical-reset or firmware-signature assurance.
|
| Brute-force protection
|
Exist
|
[[10] 🔗 Proof]
|
Automatic blocking is explicitly enabled in the reference profile: failed-logon count/time threshold blocks the source IP for a configured interval.
|
| Event logging
|
Access event logged
|
[[11] 🔗 Proof]
|
Vendor support confirms TOS6 records TNAS.online connections in Control Panel > System Logs > HTTP. This covers login/access events, not every disk operation.
|
| Passwords
|
Require change after setup with complexity requirements
|
[[12] 🔗 Proof]
|
Rubric interpretation: mandatory first-use creation of an administrator password is treated as replacing factory credentials during setup. TOS6 default rules require >=8 characters, mixed case and numbers. Forced periodic/post-setup password changes are NOT established.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
TerraMaster TOS; assessment scoped to TOS 6.0.783 (Companion App: TOS web interface; TNAS PC; TNAS Mobile; TerraSync)
|
| Hardware (CPU / GPU)
|
CPU: Intel N95, 4 cores / 4 threads, up to 3.4 GHz • GPU: Integrated Intel UHD Graphics
|
| Memory & Storage
|
Memory: 8 GB DDR5 non-ECC SODIMM; 1 slot; maximum 32 GB • Storage: Diskless: 4 SATA drive bays and 2 M.2 2280 NVMe PCIe Gen3 x1 slots
|
| Power, Battery & Charging
|
Battery: Not applicable: externally powered desktop NAS; no operating battery • Power: 90 W external adapter, 100-240 V AC, 50/60 Hz; vendor test 33 W read/write, 13 W hibernation • Charging: Not applicable: external AC power, no battery charging
|
| Display & Camera
|
Display: Status LEDs; no built-in screen; HDMI 2.0b output • Camera: No integrated camera; external IP cameras require separate hardware
|
| Sound & Connectivity
|
Sound: System alert buzzer; fan noise • Connectivity: 2 x 2.5GbE RJ45; 2 x USB 3.2 10Gbps; HDMI 2.0b; Wake-on-LAN
|
| Physical (Dimensions & Mass)
|
Dimensions: 222 x 179 x 154 mm (H x W x D) • Mass: 3.4 kg
|
Documentation-only assessment; no device was tested and no certification is claimed. Features depend on installed firmware and configuration. Reference profile: ordinary unencrypted data folders; named accounts, password rules and login-attempt blocking enabled. HTTPS management where stated. Storage rating describes the ordinary data folder and must not be read as a verified claim about all boot/system flash. None for prior attacks means no qualifying model-specific incident identified in focused vendor, NVD/CISA and security-research searches as of 2026-10-23. Frequency labels are qualitative assessor interpretations, not measured incident rates. TerraMaster communication rating specifically assesses the documented HTTP LAN-management path. Password option is a stated closest-match interpretation of mandatory first-use password creation plus complexity, not evidence of forced post-setup rotation. Hardware tampering is rated Rare as a qualitative judgment for physical-access-dependent actions, not a measured frequency. Release-date scope: Date of official vendor-support announcement introducing F4-424, F2-424 and F4-424 Pro. Announcement says availability soon; this is not an asserted first-shipment date. Sales-status scope: Listed for sale by manufacturer; manufacturer regional store currently out of stock. Tejar retailer lists exact F4-424 In Stock; sales status does not guarantee local stock.
Proposed IDRS calculation under the assessment scope above: Device 2, System 3, User Authentication 2, total 7, grade C. Source methodology: https://fehmijaafar.net/wiki-iot/index.php/Methodology . This documentation-based rating is not an unconditional security certification.
Firmware scope: TOS 6.0.783 documentation profile; release date refers to original hardware announcement, not this later OS. HTTP management and ordinary unencrypted shared folder explicitly assessed. No live device testing.
Additional references:
