CVE-2022-24990

TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative...

7.5 HighIn KEVPublic exploit

TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

83.2%Up 79.9 points since Feb 8, 2023

What each source reports

NVD Score used 7.5

Record: CVE-2022-24990
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-306
Updated: 2026-11-02

CVE List 9.8

Record: CVE-2022-24990
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-306
Updated: 2026-11-02

EUVDEUVD-2022-29737 9.8

Record: EUVD-2022-29737
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-hp68-7f8q-r2qj 7.5

TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative...

Record: GHSA-hp68-7f8q-r2qj
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-306
Updated: 2026-11-02

CISA KEV No score

TerraMaster OS Remote Command Execution Vulnerability

TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.

Record: CVE-2022-24990
Weakness: CWE-306
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	TerraMaster TOS 4.2.29 or lower - Unauthenticated RCE chaining CVE-2022-24990 and CVE-2022-24989	2022-03-07
PoC in GitHub	Jaky5155/CVE-2022-24990-TerraMaster-TOS--PHP-	2022-03-08
PoC in GitHub	VVeakee/CVE-2022-24990-POC	2022-03-10
PoC in GitHub	0xf4n9x/CVE-2022-24990	2022-03-20
PoC in GitHub	lishang520/CVE-2022-24990	2022-03-20
PoC in GitHub	ZZ-SOCMAP/CVE-2022-24990	2022-04-12
PoC in GitHub	jsongmax/terraMaster-CVE-2022-24990	2022-10-17
Nuclei	TerraMaster TOS < 4.2.30 Server Information Disclosure

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation, exploits
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-24990 is a high vulnerability (CVSS 7.5) in Terra-master Terramaster Operating System, published February 7, 2023. CISA lists it as known to be exploited, since February 10, 2023. EUVD reports exploitation since February 10, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 83.2%, the 99th percentile. No source names a fixed version.