CVE-2022-24989: TerraMaster Operating System

Critical severity, CVSS 9.8. EPSS: 31.9% chance of exploitation in the next 30 days.

TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. (Shell metacharacters can be placed in raidtype because popen is used without any sanitization.) The credentials from CVE-2022-24990 exploitation can be used.

Affected products

• TerraMaster TerraMaster Operating System: before 4.2.31 (fixed in 4.2.31)

Published 2023-08-20. Last modified 2026-06-17.