TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/…

published 2023-02-07 3 y ago modified 2026-06-17 4 mo ago also EUVD-2022-29737

cvss: 9.8; version 3.1, CNA
cisa kev: Exploited; added 2023-02-10, used in ransomware
epss: 83.2%; EPSS 83.2% chance of exploitation in 30 days, percentile 99.6%
public exploits: 1; Metasploit, plus a Nuclei check

TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.

Patch / fix

cisa required action Apply updates per vendor instructions.

fixed in 1

terra-master terramaster_operating_system 4.2.31

Timeline

2022-03-07 First public exploit (Metasploit exploit/linux/http/terramaster_unauth_rce_cve_2022_24990)
2023-02-07 Published
2023-02-10 Added to CISA KEV
2023-03-03 CISA patch deadline
2023-12-22 CISA SSVC: exploitation active

Known exploited

Added: 3 y ago (2023-02-10)
Patch by: 2023-03-03 (3 y ago)
Ransomware: Known to be used in ransomware campaigns
Required action: Apply updates per vendor instructions.
Vendor, product: TerraMaster, TerraMaster OS
CISA name: TerraMaster OS Remote Command Execution Vulnerability

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: yes
Technical impact: total
Assessed: 2 y ago (2023-12-22)

Exploit prediction

83.17% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/linux/http/terramaster_unauth_rce_cve_2022_24990 TerraMaster TOS 4.2.29 or lower - Unauthenticated RCE chaining CVE-2022-24990 and CVE-2022-24989 metasploit exploit, excellent rank, 2022-03-07
Nuclei template TerraMaster TOS < 4.2.30 Server Information Disclosure nuclei detection template
github.com https://github.com/0xf4n9x/CVE-2022-24990 referenced PoC, tagged "exploit" by a source, unverified
octagon.net https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/ referenced PoC, tagged "exploit" by a source, unverified
packetstormsecurity.com http://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

Weakness

CWE-306 Missing Authentication for Critical Functionality

References

github.com /0xf4n9x/CVE-2022-24990
exploit, third-party-advisory
octagon.net /blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instant
exploit, third-party-advisory
packetstormsecurity.com /files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html
exploit, third-party-advisory, vdb-entry
forum.terra-master.com /en/viewforum.php?f=28
issue-tracking, release-notes
broadcom.com /support/security-center/attacksignatures/detail?asid=33732
third-party-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24990
government-resource, us-government-resource

Sources

CVE List CVE-2022-24990
NVD CVE-2022-24990

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary