What’s Vulnerable › Vulnerabilities

CVE-2022-24989

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 31.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-08-20 · updated 2026-06-17
• Weakness: CWE-74

Description

TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. (Shell metacharacters can be placed in raidtype because popen is used without any sanitization.) The credentials from CVE-2022-24990 exploitation can be used.

Affected products

• Terra-Master Terramaster Operating System: before 4.2.31 — fixed in 4.2.31

How to fix

Upgrade to a fixed version: Terra-Master Terramaster Operating System 4.2.31. Check the vendor advisory for mitigations.

References

• https://attackerkb.com/topics/h8YKVKx21t/cve-2022-24990
• https://forum.terra-master.com/en/viewforum.php?f=28
• https://github.com/0xf4n9x/CVE-2022-24990
• https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation
• https://packetstormsecurity.com/files/172904
• https://attackerkb.com/topics/h8YKVKx21t/cve-2022-24990
• https://forum.terra-master.com/en/viewforum.php?f=28
• https://github.com/0xf4n9x/CVE-2022-24990
• https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation
• https://packetstormsecurity.com/files/172904

Get alerted when CVE-2022-24989 or the next vulnerability affects your stack