Back to Database
Status published
Unknown
CVE-2022-24990
TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover...
Vulnerability Description
TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-24990
Credits & Attribution
No credits recorded in the NVD database.
References
- https://forum.terra-master.com/en/viewforum.php?f=28
- https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732
- https://github.com/0xf4n9x/CVE-2022-24990
- https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/
- http://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html
More from terra-master
View All →CVE-2022-24989
TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute...
Critical
9.8
CVE-2021-45842
It is possible to obtain the first administrator's hash set...
High
7.5
CVE-2021-45841
In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can...
High
8.1
CVE-2021-45840
It is possible to execute arbitrary commands as root in...
Critical
9.8
CVE-2021-45839
It is possible to obtain the first administrator's hash set...
Medium
6.5
Affected Vendor
terra-master
View all reports →Affected Software
terramaster operating system
Vulnerable Versions:
0
Timeline
Official Publish:
February 7th, 2023
Last Modified:
October 21st, 2025
Added to House:
July 21st, 2026
CVSS Vectors
No vector data available
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.