CVE-2022-24990

🗓️ 07 Feb 2023 00:00:00Reported by mitreType

cve

cve🔗 web.nvd.nist.gov👁 703 Views🌐 WEB

TerraMaster NAS 4.2.29 allows remote attackers to discover admin password

Reporter	Title	Published	Views	Family All 40
GithubExploit	Exploit for Missing Authentication for Critical Function in Terra-Master Terramaster_Operating_System	17 Oct 202207:54	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Terra-Master Terramaster_Operating_System	10 Mar 202203:16	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Terra-Master Terramaster_Operating_System	12 Apr 202202:45	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Terra-Master Terramaster_Operating_System	20 Mar 202205:15	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Terra-Master Terramaster_Operating_System	20 Mar 202205:21	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Terra-Master Terramaster_Operating_System	12 Apr 202202:45	–	githubexploit
ICS	#StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities	9 Feb 202312:00	–	ics
ICS	North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime’s Military and Nuclear Programs	25 Jul 202412:00	–	ics
ATTACKERKB	CVE-2021-45837	25 Apr 202200:00	–	attackerkb
ATTACKERKB	CVE-2020-35665	23 Dec 202000:00	–	attackerkb

NVD

Node

terra-master terramaster_operating_systemRange<4.2.31

AND

terra-master f2-210Match-

OR

terra-master f2-221Match-

OR

terra-master f2-223Match-

OR

terra-master f2-422Match-

OR

terra-master f2-423Match-

OR

terra-master f4-421Match-

OR

terra-master f4-422Match-

OR

terra-master f4-423Match-

OR

terra-master f5-221Match-

OR

terra-master f5-422Match-

OR

terra-master t12-423Match-

OR

terra-master t12-450Match-

OR

terra-master t6-423Match-

OR

terra-master t9-423Match-

OR

terra-master t9-450Match-

OR

terra-master u12-322-9100Match-

OR

terra-master u12-423Match-

OR

terra-master u12-722-2224Match-

OR

terra-master u16-322-9100Match-

OR

terra-master u16-722-2224Match-

OR

terra-master u24-722-2224Match-

OR

terra-master u4-111Match-

OR

terra-master u4-211Match-

OR

terra-master u4-423Match-

OR

terra-master u8-111Match-

OR

terra-master u8-322-9100Match-

OR

terra-master u8-423Match-

OR

terra-master u8-522-9400Match-

OR

terra-master u8-722-2224Match-

Source	Link
forum	www.forum.terra-master.com/en/viewforum.php
broadcom	www.broadcom.com/support/security-center/attacksignatures/detail
octagon	www.octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/
packetstormsecurity	www.packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html
github	www.github.com/0xf4n9x/CVE-2022-24990
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
User-Agent	header	module/api.php?mobile/webNasIPS	Information leakage: administrative password can be exposed via webNasIPS when sending a specific User-Agent.	CWE-306
raidtype	request body	module/api.php?mobile/createRaid	Unauthenticated remote code execution by abusing a vulnerable createRaid endpoint after information leakage.	CWE-306
diskstring	request body	module/api.php?mobile/createRaid	Unauthenticated remote code execution by abusing a vulnerable createRaid endpoint after information leakage.	CWE-306

07 Nov 2025 19:02Current

8.7High risk

Vulners AI Score8.7

CVSS 3.17.5 - 9.8

EPSS0.94404

SSVC

CWE-306 In Wild

terramaster nas cve-2022-24990 security vulnerability remote attack