ZeroDay Findings
Sign inSign up

Findings

CVE-2022-24990

TerraMaster OS Remote Command Execution Vulnerability

Published Feb 7, 2023 · updated Jun 16, 2026 · terra-master terramaster operating system

TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 7, 2023 · Catalog

    Detected

    TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.

  2. Feb 10, 2023 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Mar 3, 2023 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.

Required action

Apply updates per vendor instructions.

CISA due date Mar 3, 2023

Affected

  • cpe terra-master/terramaster operating systemversion unspecified
  • vendor TerraMaster TerraMaster OSversion unspecified

Sources

  • CISA KEVCVE-2022-24990

    TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.

    cisa.gov
  • CVE.orgCVE-2022-24990

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2022-24990

    30-day exploitation probability 83.2%

    first.org
  • Metasploit Modulesexploit_linux/http/terramaster_unauth_rce_cve_2022_24990

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2022-24990

    TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References