CVE-2022-24989
52Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actepss 32%
de la publicación al arma0 días
Publicada en NVD20 ago
metasploit7 mar
VulnCheck+186d
probabilidad de explotación
32%top 2% de las CVE
explotación observada
síVulnCheck
TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. (Shell metacharacters can be placed in raidtype because popen is used without any sanitization.) The credentials from CVE-2022-24990 exploitation can be used.
Productos afectados
n/a · n/aReferencias
https://attackerkb.com/topics/h8YKVKx21t/cve-2022-24990https://forum.terra-master.com/en/viewforum.php?f=28https://github.com/0xf4n9x/CVE-2022-24990https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiationhttps://packetstormsecurity.com/files/172904