CVE-2022-24990 KEV
7.5
HIGH · CVSS 3.1 · EPSS 83% (pctl 100)
Patch first
On CISA KEV — known exploited in the wild, due 2023-03-03.
Description
TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.
Scoring
| CVSS | 7.5 (HIGH, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| EPSS | 83.04% — more likely to be exploited than 100% of all CVEs |
| Weakness | CWE-306 |
| On CISA KEV | yes — remediate by 2023-03-03 |
| Public exploit | none known |
| Published | 2023-02-07 |
| Last modified | 2026-06-17 |
CISA KEV
| Name | TerraMaster OS Remote Command Execution Vulnerability |
|---|---|
| Added | 2023-02-10 |
| Due | 2023-03-03 |
| Vendor / product | TerraMaster / TerraMaster OS |
| Ransomware use | known |
Affected (30)
| Vendor | Product |
|---|---|
| terra-master | f2-210 |
| terra-master | f2-221 |
| terra-master | f2-223 |
| terra-master | f2-422 |
| terra-master | f2-423 |
| terra-master | f4-421 |
| terra-master | f4-422 |
| terra-master | f4-423 |
| terra-master | f5-221 |
| terra-master | f5-422 |
| terra-master | t12-423 |
| terra-master | t12-450 |
| terra-master | t6-423 |
| terra-master | t9-423 |
| terra-master | t9-450 |
| terra-master | terramaster operating system |
| terra-master | u12-322-9100 |
| terra-master | u12-423 |
| terra-master | u12-722-2224 |
| terra-master | u16-322-9100 |
| terra-master | u16-722-2224 |
| terra-master | u24-722-2224 |
| terra-master | u4-111 |
| terra-master | u4-211 |
| terra-master | u4-423 |
| terra-master | u8-111 |
| terra-master | u8-322-9100 |
| terra-master | u8-423 |
| terra-master | u8-522-9400 |
| terra-master | u8-722-2224 |
References
- http://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html
- https://forum.terra-master.com/en/viewforum.php?f=28
- https://github.com/0xf4n9x/CVE-2022-24990
- https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/
- https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732
- http://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html
- https://forum.terra-master.com/en/viewforum.php?f=28
- https://github.com/0xf4n9x/CVE-2022-24990
- https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/
- https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24990
→ the Explorer · watch your stack · NVD