CVE-2022-24989

🗓️ 20 Aug 2023 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 219 Views🌐 WEB

TerraMaster NAS through 4.2.30 allows remote execution of arbitrary code via api.php?mobile/createRai

Reporter	Title	Published	Views	Family All 58
GithubExploit	Exploit for Missing Authentication for Critical Function in Terra-Master Terramaster_Operating_System	17 Oct 202207:54	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Terra-Master Terramaster_Operating_System	10 Mar 202203:16	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Terra-Master Terramaster_Operating_System	12 Apr 202202:45	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Terra-Master Terramaster_Operating_System	20 Mar 202205:15	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Terra-Master Terramaster_Operating_System	20 Mar 202205:21	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Terra-Master Terramaster_Operating_System	12 Apr 202202:45	–	githubexploit
ICS	#StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities	9 Feb 202312:00	–	ics
ICS	North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime’s Military and Nuclear Programs	25 Jul 202412:00	–	ics
attackerkb	CVE-2020-35665	23 Dec 202000:00	–	attackerkb
attackerkb	CVE-2022-24990	7 Feb 202300:00	–	attackerkb

NVD

Vulnrichment

Node

AND

Source	Link
forum	www.forum.terra-master.com/en/viewforum.php
octagon	www.octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation
github	www.github.com/0xf4n9x/CVE-2022-24990
packetstormsecurity	www.packetstormsecurity.com/files/172904
attackerkb	www.attackerkb.com/topics/h8YKVKx21t/cve-2022-24990

Parameter	Position	Path	Description	CWE
mobile/webNasIPS	query param	/module/api.php?mobile/webNasIPS	Information disclosure vulnerability (CVE-2022-24990) that leaks sensitive information including admin password hash and MAC address when accessed with a specific User-Agent.	CWE-200
mobile/wapNasIPS	query param	/module/api.php?mobile/wapNasIPS	Information disclosure vulnerability (CVE-2022-24990) that leaks sensitive information including admin password hash and MAC address when accessed with a specific User-Agent.	CWE-200
raidtype	query param	/module/api.php?mobile/createRaid	Remote Code Execution (RCE) via PHP Object Instantiation (CVE-2022-24989). The 'raidtype' parameter is vulnerable to shell metacharacters because 'popen' is used without sanitization.	CWE-74
diskstring	query param	/module/api.php?mobile/createRaid	Remote Code Execution (RCE) via PHP Object Instantiation (CVE-2022-24989). The 'raidtype' parameter is vulnerable to shell metacharacters because 'popen' is used without sanitization.	CWE-74
user/login	query param	/tos/index.php?user/login	Endpoint used to retrieve TOS version and CPU architecture information for vulnerability verification.	CWE-200

17 Jun 2026 04:32Current

9Critical risk

Vulners AI Score9

CVSS 3.19.8

EPSS0.83166

SSVC