CVE-2022-24990

HIGHCISA KEV

7.5

Description

TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.

CVE Details

CVSS v3.1 Score7.5

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published2/7/2023

Last Modified11/7/2025

Sourcekev

Honeypot Sightings0

CISA KEV

VendorTerraMaster

ProductTerraMaster OS

Vulnerability NameTerraMaster OS Remote Command Execution Vulnerability

KEV Date Added2023-02-10

Remediation Due Date2023-03-03

Ransomware UseKnown

Affected Products

terra-master:f2-210terra-master:f2-221terra-master:f2-223terra-master:f2-422terra-master:f2-423terra-master:f4-421terra-master:f4-422terra-master:f4-423terra-master:f5-221terra-master:f5-422terra-master:t12-423terra-master:t12-450terra-master:t6-423terra-master:t9-423terra-master:t9-450terra-master:terramaster_operating_systemterra-master:u12-322-9100terra-master:u12-423terra-master:u12-722-2224terra-master:u16-322-9100terra-master:u16-722-2224terra-master:u24-722-2224terra-master:u4-111terra-master:u4-211terra-master:u4-423terra-master:u8-111terra-master:u8-322-9100terra-master:u8-423terra-master:u8-522-9400terra-master:u8-722-2224

Weaknesses (CWE)

CWE-306CWE-306

References

http://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html(cve@mitre.org)

https://forum.terra-master.com/en/viewforum.php?f=28(cve@mitre.org)

https://github.com/0xf4n9x/CVE-2022-24990(cve@mitre.org)

https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/(cve@mitre.org)

https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732(cve@mitre.org)

http://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html(af854a3a-2127-422b-91ae-364da2661108)

https://forum.terra-master.com/en/viewforum.php?f=28(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/0xf4n9x/CVE-2022-24990(af854a3a-2127-422b-91ae-364da2661108)

https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/(af854a3a-2127-422b-91ae-364da2661108)

https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24990(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.