CVE-2022-24989
52Vexday Risk Score
Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.
ssvc Actepss 32%
da publicação à arma0 dias
Publicada no NVD20 de ago.
metasploit7 de mar.
VulnCheck+186d
probabilidade de exploração
32%top 2% das CVEs
exploração observada
simVulnCheck
TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. (Shell metacharacters can be placed in raidtype because popen is used without any sanitization.) The credentials from CVE-2022-24990 exploitation can be used.
Produtos afetados
n/a · n/aReferências
https://attackerkb.com/topics/h8YKVKx21t/cve-2022-24990https://forum.terra-master.com/en/viewforum.php?f=28https://github.com/0xf4n9x/CVE-2022-24990https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiationhttps://packetstormsecurity.com/files/172904