CVE-2022-24989

CRITICAL 9.8CVE-2022-24989 · Published 20/08/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. (Shell metacharacters can be placed in raidtype because popen is used without any sanitization.) The credentials from CVE-2022-24990 exploitation can be used.

References

attackerkb.com/topics/h8YKVKx21t/cve-2022-24990 · Third Party Advisory
forum.terra-master.com/en/viewforum.php · Release Notes
0xf4n9x/CVE-2022-24990 · Exploit
octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation · Exploit
packetstormsecurity.com/files/172904 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free