CVE-2022-24990

HIGHCISA KEV

7.5

Descripcion

TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.

Detalles CVE

Puntuacion CVSS v3.17.5

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioNONE

Publicado2/7/2023

Ultima modificacion11/7/2025

Fuentekev

Avistamientos honeypot0

CISA KEV

VendedorTerraMaster

ProductoTerraMaster OS

Nombre vulnerabilidadTerraMaster OS Remote Command Execution Vulnerability

Fecha inclusion KEV2023-02-10

Fecha limite remediacion2023-03-03

Uso en ransomwareKnown

Productos afectados

terra-master:f2-210terra-master:f2-221terra-master:f2-223terra-master:f2-422terra-master:f2-423terra-master:f4-421terra-master:f4-422terra-master:f4-423terra-master:f5-221terra-master:f5-422terra-master:t12-423terra-master:t12-450terra-master:t6-423terra-master:t9-423terra-master:t9-450terra-master:terramaster_operating_systemterra-master:u12-322-9100terra-master:u12-423terra-master:u12-722-2224terra-master:u16-322-9100terra-master:u16-722-2224terra-master:u24-722-2224terra-master:u4-111terra-master:u4-211terra-master:u4-423terra-master:u8-111terra-master:u8-322-9100terra-master:u8-423terra-master:u8-522-9400terra-master:u8-722-2224

Debilidades (CWE)

CWE-306CWE-306

Referencias

http://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html(cve@mitre.org)

https://forum.terra-master.com/en/viewforum.php?f=28(cve@mitre.org)

https://github.com/0xf4n9x/CVE-2022-24990(cve@mitre.org)

https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/(cve@mitre.org)

https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732(cve@mitre.org)

http://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html(af854a3a-2127-422b-91ae-364da2661108)

https://forum.terra-master.com/en/viewforum.php?f=28(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/0xf4n9x/CVE-2022-24990(af854a3a-2127-422b-91ae-364da2661108)

https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/(af854a3a-2127-422b-91ae-364da2661108)

https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24990(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.