Apache mod_proxy SSRF vulnerability (CVE-2021-40438)

Sep 09, 2026

Server-Side Request Forgery (SSRF) via a crafted request URI bypasses proxy controls.

Vulnerability ID	Vulnerability Overview
CVE-2021-40438	A crafted request uri-path can cause `mod_proxy` to forward the request to an arbitrary server dictated by the attacker, exposing internal networks.

Affected Supported TeraStations

TS5010/3020/3010
Fixed in firmware version 6.12

Date	Description
09/09/2026	Initial release