Evil-DB LogoEvil-DB
← All CVEs

CVE-2022-24989

critical · 9.8

TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. (Shell metacharacters can be placed in raidtype because popen is used without any sanitization.) The credentials from CVE-2022-24990 exploitation can be used.

9.8
CVSS
31.9%
EPSS (exploit prob.)
98th
EPSS percentile
2023-08-20
Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-74

Affected products

VendorProductAffected versions
terra-masterterramaster_operating_system< 4.2.31
terra-masterf2-210all versions
terra-masterf2-221all versions
terra-masterf2-223all versions
terra-masterf2-422all versions
terra-masterf2-423all versions
terra-masterf4-421all versions
terra-masterf4-422all versions
terra-masterf4-423all versions
terra-masterf5-221all versions
terra-masterf5-422all versions
terra-mastert12-423all versions
terra-mastert12-450all versions
terra-mastert6-423all versions
terra-mastert9-423all versions
terra-mastert9-450all versions
terra-masteru12-322-9100all versions
terra-masteru12-423all versions
terra-masteru12-722-2224all versions
terra-masteru16-322-9100all versions
terra-masteru16-722-2224all versions
terra-masteru24-722-2224all versions
terra-masteru4-111all versions
terra-masteru4-211all versions
terra-masteru4-423all versions
terra-masteru8-111all versions
terra-masteru8-322-9100all versions
terra-masteru8-423all versions
terra-masteru8-522-9400all versions
terra-masteru8-722-2224all versions

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2022-24989