CVE-2022-24989 - CVE House
Back to Database
Status published Critical CVE-2022-24989

TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute...

Vulnerability Description

TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. (Shell metacharacters can be placed in raidtype because popen is used without any sanitization.) The credentials from CVE-2022-24990 exploitation can be used.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-24989

Credits & Attribution

No credits recorded in the NVD database.

References

More from terra-master

View All →
CVE-2022-24990
TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover...
Unknown 0
CVE-2021-45842
It is possible to obtain the first administrator's hash set...
High 7.5
CVE-2021-45841
In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can...
High 8.1
CVE-2021-45840
It is possible to execute arbitrary commands as root in...
Critical 9.8
CVE-2021-45839
It is possible to obtain the first administrator's hash set...
Medium 6.5

Affected Vendor

terra-master

View all reports →

Affected Software

terramaster operating system
Vulnerable Versions:
0

Timeline

Official Publish: August 20th, 2023
Last Modified: October 8th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.