CVE-2022-24990
TerraMaster OS Remote Command Execution Vulnerability
Description
CVE-2022-24990 is an information disclosure vulnerability in TerraMaster NAS devices running TOS version 4.2.29 and earlier, caused by missing authentication for a critical API function. By sending a specially crafted HTTP request with the User-Agent header set to "TNAS" to the module/api.php?mobile/webNasIPS endpoint, a remote unauthenticated attacker can retrieve the administrative password in plaintext from the PWD field in the response. This TerraMaster NAS vulnerability has been confirmed actively exploited in the wild and is associated with known ransomware campaigns. With an EPSS score of 94.4% (99th percentile) and a CVSS score of 7.5 (High), CVE-2022-24990 represents one of the most actively targeted NAS vulnerabilities.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| terra-master | terramaster operating system | < 4.2.31 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://forum.terra-master.com/en/viewforum.php?f=28(Issue Tracking, Release Notes)
- https://github.com/0xf4n9x/CVE-2022-24990(Exploit, Third Party Advisory)
- https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/(Exploit, Third Party Advisory)
- https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24990(US Government Resource)
Weakness Type
CWE-306: Missing Authentication for Critical Function
Missing authentication for critical function occurs when software does not require authentication before allowing access to functionality that should be restricted. In CVE-2022-24990, the TerraMaster NAS API endpoint module/api.php?mobile/webNasIPS fails to require any authentication, allowing unauthenticated remote attackers to access the administrative password by simply setting the correct User-Agent header.
Learn more: CWE-306 — Missing Authentication for Critical Function
Impact Analysis
Attack Vector (Network): CVE-2022-24990 is remotely exploitable without physical access — any attacker who can reach the TerraMaster NAS web interface over the network can exploit this vulnerability. Attack Complexity (Low): Exploitation is trivial, requiring only a single HTTP request with a modified User-Agent header. Privileges Required (None): No authentication or prior access is needed to exploit this flaw. User Interaction (None): The attack is fully automated and requires no action from any user. Confidentiality (High): Successful exploitation exposes the administrative password in plaintext, giving the attacker full access to the NAS device and all stored data. Integrity and Availability (None directly): While the vulnerability itself only discloses the password, obtaining administrator credentials enables subsequent attacks that can compromise data integrity and device availability. The CVSS score of 7.5 (High severity) reflects the direct confidentiality impact. The EPSS score of 94.4% — placing it in the 99th percentile — indicates near-certain exploitation activity, and the confirmed ransomware association means that NAS devices exposed to the internet are at extreme risk of data encryption and extortion.
Exploit Maturity
Active exploitation of CVE-2022-24990 has been confirmed by CISA, which added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of March 3, 2023. This TerraMaster NAS vulnerability is associated with known ransomware campaigns targeting network-attached storage devices. Public exploit code is available for CVE-2022-24990 via Packet Storm Security, GitHub (0xf4n9x), and a detailed technical writeup by Octagon Networks. The EPSS score of 94.4% (99th percentile) indicates near-certain exploitation activity, making this one of the most actively targeted vulnerabilities in the current threat landscape.
Remediation
- Update TerraMaster TOS immediately. Upgrade to a TOS version newer than 4.2.29 that addresses CVE-2022-24990. Check the TerraMaster forum for the latest firmware releases. As directed by CISA: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable."
- Remove TerraMaster NAS devices from direct internet exposure. Do not expose the NAS web interface to the public internet. Place NAS devices behind a firewall and restrict access to trusted internal networks only. Use a VPN for remote access instead of direct port forwarding.
- Change all administrative passwords immediately. If the NAS has been exposed to the internet while running TOS 4.2.29 or earlier, assume the admin password has been compromised. Change the admin password and all user passwords, and audit the NAS for unauthorized access or modifications.
- Monitor for ransomware indicators and unauthorized access. Review NAS access logs for requests to module/api.php?mobile/webNasIPS with User-Agent "TNAS". Check for unexpected file encryption, new user accounts, scheduled tasks, or other signs of compromise.
- Implement network segmentation for storage devices. Place NAS devices on a dedicated VLAN with restricted access policies. Enforce authentication requirements for all management interfaces and disable any unnecessary API endpoints or remote management features.
Technical Details
Vulnerability Mechanism: CVE-2022-24990 is a missing authentication vulnerability (CWE-306) in the TerraMaster NAS operating system (TOS) version 4.2.29 and earlier. The API endpoint at module/api.php?mobile/webNasIPS is designed for mobile application integration but lacks any authentication check. When the endpoint receives a request with the User-Agent header set to "TNAS", it returns system information including the administrative password in the PWD field of the response body. Exploitation Path: A remote attacker sends a simple HTTP GET request to the target NAS with the custom User-Agent header, requiring no credentials, no cookies, and no session tokens. The server responds with the admin password in cleartext, which can then be used to log in with full administrative privileges and execute commands on the NAS. CVSS Vector Analysis: The vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N confirms that this is a network-accessible, trivially exploitable vulnerability requiring no privileges or user interaction, with high confidentiality impact but no direct integrity or availability effect from the disclosure itself.
Frequently Asked Questions
Is CVE-2022-24990 being actively exploited?
Yes, CVE-2022-24990 is being actively exploited at a massive scale. CISA has added it to its Known Exploited Vulnerabilities catalog, and it is associated with known ransomware campaigns targeting NAS devices. The EPSS score of 94.4% (99th percentile) confirms near-certain exploitation activity.
What products are affected by CVE-2022-24990?
CVE-2022-24990 affects TerraMaster NAS devices running TerraMaster Operating System (TOS) version 4.2.29 and earlier. All TerraMaster NAS models running vulnerable firmware versions are affected, regardless of the hardware model.
How do I fix CVE-2022-24990?
Update TerraMaster TOS to a version newer than 4.2.29 from the official TerraMaster forum. Immediately remove any internet-facing exposure of the NAS web interface and change all administrative passwords, as they may have already been compromised. Place NAS devices behind a firewall and use VPN for remote access.
How severe is CVE-2022-24990?
CVE-2022-24990 has a CVSS score of 7.5 (High severity) due to unauthenticated remote disclosure of administrative credentials. The EPSS score of 94.4% places it in the 99th percentile, indicating near-certain exploitation. Combined with confirmed ransomware association and publicly available exploits, this is an extremely high-risk vulnerability for any exposed TerraMaster NAS device.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.