peter bassill · operator
$ cve CVE-2022-24989 JSON

CVE-2022-24989

9.8
CRITICAL · CVSS 3.1 · EPSS 31.9% (pctl 98)

Patch early

EPSS 31.9% — above the 10% action threshold.

Description

TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. (Shell metacharacters can be placed in raidtype because popen is used without any sanitization.) The credentials from CVE-2022-24990 exploitation can be used.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS31.88% — more likely to be exploited than 98% of all CVEs
WeaknessCWE-74
On CISA KEVno
Public exploitnone known
Published2023-08-20
Last modified2026-06-17

Affected (30)

VendorProduct
terra-masterf2-210
terra-masterf2-221
terra-masterf2-223
terra-masterf2-422
terra-masterf2-423
terra-masterf4-421
terra-masterf4-422
terra-masterf4-423
terra-masterf5-221
terra-masterf5-422
terra-mastert12-423
terra-mastert12-450
terra-mastert6-423
terra-mastert9-423
terra-mastert9-450
terra-masterterramaster operating system
terra-masteru12-322-9100
terra-masteru12-423
terra-masteru12-722-2224
terra-masteru16-322-9100
terra-masteru16-722-2224
terra-masteru24-722-2224
terra-masteru4-111
terra-masteru4-211
terra-masteru4-423
terra-masteru8-111
terra-masteru8-322-9100
terra-masteru8-423
terra-masteru8-522-9400
terra-masteru8-722-2224

References

→ the Explorer  ·  watch your stack  ·  NVD