Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2022-24989
HistoryAug 20, 2023 - 6:15 p.m.

CVE-2022-24989

2023-08-2018:15:00
CWE-74
[email protected]
web.nvd.nist.gov
31
In Wild
cve-2022-24989
terramaster
nas
remote execution
arbitrary code
security vulnerability
nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.1 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.003 Low

EPSS

Percentile

70.6%

JSON

TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. (Shell metacharacters can be placed in raidtype because popen is used without any sanitization.) The credentials from CVE-2022-24990 exploitation can be used.

Related

thn 3
prion 2
nessus 1
packetstorm 1
metasploit 1
cnvd 2
attackerkb 3
openvas 1
rapid7blog 1
cve 1
githubexploit 6
cisa_kev 1
nuclei 1
ics 1
thn
thn
Critical Bugs in TerraMaster TOS Could Open NAS Devices to Remote Hacking
2022-03-07 16:42:00
CISA Warns of Active Attacks Exploiting Fortra MFT, TerraMaster NAS, and Intel Driver Flaws
2023-02-11 05:45:00
North Korean Hackers Targeting Healthcare with Ransomware to Fund its Operations
2023-02-10 11:52:00
prion
prion
Code injection
2023-08-20 18:15:00
Default credentials
2023-02-07 18:15:00
nessus
nessus
TerraMaster TOS < 4.2.30 Command Injection (CVE-2022-24990)
2023-06-02 00:00:00
packetstorm
packetstorm
TerraMaster TOS 4.2.29 Remote Code Execution
2023-06-13 00:00:00
metasploit
metasploit
TerraMaster TOS 4.2.29 or lower - Unauthenticated RCE chaining CVE-2022-24990 and CVE-2022-24989
2023-06-10 09:42:32
cnvd
cnvd
TerraMasterTOS Command Injection Vulnerability
2022-03-09 00:00:00
TerraMaster TOS Identity Bypass Vulnerability
2022-03-09 00:00:00
attackerkb
attackerkb
CVE-2022-24990
2023-02-07 00:00:00
CVE-2020-35665
2020-12-23 00:00:00
CVE-2021-45837
2022-04-25 00:00:00
openvas
openvas
Terramaster TOS < 4.2.31 Multiple Information Disclosure Vulnerabilities - Active Check
2023-02-22 00:00:00
rapid7blog
rapid7blog
Metasploit Weekly Wrap-Up
2023-06-16 20:40:51
cve
cve
CVE-2022-24990
2023-02-07 18:15:00
githubexploit
githubexploit
Exploit for Missing Authentication for Critical Function in Terra-Master Terramaster Operating System
2022-04-12 02:45:56
Exploit for Missing Authentication for Critical Function in Terra-Master Terramaster Operating System
2022-10-17 07:54:13
Exploit for CVE-2022-24990
2022-03-11 01:06:26
cisa_kev
cisa_kev
TerraMaster OS Remote Command Execution Vulnerability
2023-02-10 00:00:00
nuclei
nuclei
TerraMaster TOS < 4.2.30 Server Information Disclosure
2022-03-08 01:05:30
ics
ics
#StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities
2023-02-09 12:00:00

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.1 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.003 Low

EPSS

Percentile

70.6%

JSON
Related for CVE-2022-24989
thn3prion2nessus1packetstorm1metasploit1cnvd2attackerkb3openvas1rapid7blog1cve1githubexploit6cisa_kev1nuclei1ics1