Security and the Internet of Things (IoT) are commonly discussed, though rarely in a positive light. In 2018, the state of security in embedded devices appears to be a continuation of this trend, according to research performed by Independent Security Evaluators (ISE). As part of our research, we have looked at a variety of devices aimed at the professional consumer and small business market including the TerraMaster F2-420 Network Attached Storage (NAS). In the F2-420, we found several glaring vulnerabilities, including some that allow remote attackers to gain root access without any authentication. In the course of a few days, ISE obtained 24 CVEs for vulnerabilities we discovered in the TerraMaster F2-420. This presentation will cover some of the issues affecting the NAS, and provide sample attack workflows for compromising a network-accessible F2-420. More importantly, it will describe a methodology for finding vulnerabilities in embedded devices by examining all available attack surfaces.