CVE-2022-24989

CRITICAL CVSS: 9.8 Published: 2023-08-20 Modified: 2026-06-17

Description

TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. (Shell metacharacters can be placed in raidtype because popen is used without any sanitization.) The credentials from CVE-2022-24990 exploitation can be used.

Affected Platforms

Terra-Master F4-421Terra-Master F5-422Terra-Master F5-221Terra-Master T12-450Terra-Master U12-322-9100Terra-Master U16-722-2224Terra-Master U8-111Terra-Master U8-722-2224Terra-Master U8-322-9100Terra-Master U12-423

Weakness Type

CWE-74

References

https://attackerkb.com/topics/h8YKVKx21t/cve-2022-24990
https://forum.terra-master.com/en/viewforum.php?f=28
https://github.com/0xf4n9x/CVE-2022-24990
https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticate…
https://packetstormsecurity.com/files/172904
https://attackerkb.com/topics/h8YKVKx21t/cve-2022-24990