terramaster_operating_system 漏洞

严重CVE-2022-249892023/08/20

CVE-2022-24989

TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. (Shell metacharacters can be placed in raidtype because popen is used without any sanitization.) The credentials from CVE-2022-24990 exploitation can be used.

terramaster_operating_systemRCE

CVSS9.8EPSS 77.6%

高危CVE-2022-249902022/03/07

TerraMaster TOS < 4.2.30 Server Information Disclosure

TerraMaster NAS devices running TOS prior to version 4.2.30 are vulnerable to information disclosure.

terramaster_operating_systemPoC 已收录EXP 已收录

CVSS7.5EPSS 94.4%

严重CVE-2020-356652020/12/23

CVE-2020-35665

An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter in include/makecvs.php during CSV creation.

terramaster_operating_systemRCE

CVSS9.8EPSS 89.4%

terramaster_operating_system

关联漏洞

CVE-2022-24989

TerraMaster TOS < 4.2.30 Server Information Disclosure

CVE-2020-35665