CVE-2022-24989
Critical
Description
TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. (Shell metacharacters can be placed in raidtype because popen is used without any sanitization.) The credentials from CVE-2022-24990 exploitation can be used.
SeverityCritical
CVSS9.8
Exploit probability98. percentile31.9%
ProductTerra-master Terramaster Operating System
PublishedAug 20, 2023
First seenAug 20, 2023
How to fix
Update
- terra-master terramaster_operating_system4.2.31 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| terra-master terramaster_operating_system | v < 4.2.31 | 4.2.31 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.