[ CVE-2022-24990 · Published 7 Feb 2023 ]
TerraMaster OS Remote Command Execution Vulnerability
Exploited · CISA KEV CVSS 7.5
EPSS 83%No fix listed yet
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-02-10
- Known to be used in ransomware campaigns
- EPSS: 83% chance of exploitation in the next 30 days (higher than 100% of CVEs)
[ Description ]Official description
TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.
CISA: TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 3 Mar 2023): Apply updates per vendor instructions.
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ References ]References
- packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
- forum.terra-master.com/en/viewforum.phpIssue TrackingRelease Notes
- github.com/0xf4n9x/CVE-2022-24990ExploitThird Party Advisory
- octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-comman…ExploitThird Party Advisory
- www.broadcom.com/support/security-center/attacksignatures/detailThird Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource