---
id: 6151
title: "CVE-2022-24990: TerraMaster TOS unauthenticated remote command execution via PHP Object Instantiation"
cve: CVE-2022-24990
source_domain: pwn.ai
source_url: "https://pwn.ai/blog/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation"
published_at: "2022-03-07T16:20:00Z"
tags: ["pre-auth-rce", "vulnerability-chain", "terramaster", "cve-2022-24990", "nas", "php-object-instantiation"]
phying_url: "https://phying.com/item/6151"
lang: en
---

# CVE-2022-24990: TerraMaster TOS unauthenticated remote command execution via PHP Object Instantiation

## Summary

Octagon Networks' chain on TerraMaster TOS 4.2.29: a PHP object instantiation bug plus a signing-check bypass yields unauthenticated remote root command execution on NAS devices.

## Intelligence Metadata

- **Sources:** pwn.ai
- **CVE:** CVE-2022-24990
- **Published:** 2022-03-07T16:20:00Z
- **Original:** https://pwn.ai/blog/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation
- **Phying News:** https://phying.com/item/6151