TerraMaster · TerraMaster OS
CVE-2022-24990
TerraMaster OS Remote Command Execution Vulnerability
Exploited in attacks
Used by ransomware
Critical 9.8 Attack chance: 83%
What it is
TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.
CISA: TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: March 3, 2023
- Added to the CISA list
- February 10, 2023
- Published
- February 7, 2023
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 83% in the top 0.3% of all known vulnerabilities
- Weakness
- CWE-306
- More details
- NVD · CVE.org · CISA
All references (5)
- https://forum.terra-master.com/en/viewforum.php?f=28
- https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732
- https://github.com/0xf4n9x/CVE-2022-24990
- https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-vi…
- http://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.