{"id":"CVE-2022-24990","aliases":["EUVD-2022-29737","GHSA-hp68-7f8q-r2qj"],"status":"published","title":"TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative...","description":"TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending \"User-Agent: TNAS\" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.83166,"percentile":0.99682,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-306"],"published":"2023-02-07T00:00:00Z","modified":"2026-06-17T04:32:54Z","kev":{"date_added":"2023-02-10","due_date":"2023-03-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2023-02-10"},{"source":"kev","since":"2023-02-10"}],"exploits":[{"source":"metasploit","id":"exploit/linux/http/terramaster_unauth_rce_cve_2022_24990","title":"TerraMaster TOS 4.2.29 or lower - Unauthenticated RCE chaining CVE-2022-24990 and CVE-2022-24989","type":"exploit","platform":"Linux,Unix","date":"2022-03-07","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/terramaster_unauth_rce_cve_2022_24990"},{"source":"pocgithub","id":"Jaky5155/CVE-2022-24990-TerraMaster-TOS--PHP-","title":"Jaky5155/CVE-2022-24990-TerraMaster-TOS--PHP-","date":"2022-03-08","url":"https://github.com/Jaky5155/CVE-2022-24990-TerraMaster-TOS--PHP-"},{"source":"pocgithub","id":"VVeakee/CVE-2022-24990-POC","title":"VVeakee/CVE-2022-24990-POC","date":"2022-03-10","url":"https://github.com/VVeakee/CVE-2022-24990-POC"},{"source":"pocgithub","id":"0xf4n9x/CVE-2022-24990","title":"0xf4n9x/CVE-2022-24990","date":"2022-03-20","url":"https://github.com/0xf4n9x/CVE-2022-24990"},{"source":"pocgithub","id":"lishang520/CVE-2022-24990","title":"lishang520/CVE-2022-24990","date":"2022-03-20","url":"https://github.com/lishang520/CVE-2022-24990"},{"source":"pocgithub","id":"ZZ-SOCMAP/CVE-2022-24990","title":"ZZ-SOCMAP/CVE-2022-24990","date":"2022-04-12","url":"https://github.com/ZZ-SOCMAP/CVE-2022-24990"},{"source":"pocgithub","id":"jsongmax/terraMaster-CVE-2022-24990","title":"jsongmax/terraMaster-CVE-2022-24990","date":"2022-10-17","url":"https://github.com/jsongmax/terraMaster-CVE-2022-24990"},{"source":"nuclei","id":"CVE-2022-24990","title":"TerraMaster TOS \u003c 4.2.30 Server Information Disclosure","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24990.yaml"}],"products":[{"vendor":"terra-master","product":"terramaster_operating_system"},{"vendor":"terramaster","product":"terramaster os"}],"references":[{"url":"https://forum.terra-master.com/en/viewforum.php?f=28","tags":["x_transferred","Issue Tracking","Release Notes"]},{"url":"https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732","tags":["x_transferred","Third Party Advisory"]},{"url":"https://github.com/0xf4n9x/CVE-2022-24990","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24990","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24990"},{"url":"https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation"},{"url":"https://github.com/advisories/GHSA-hp68-7f8q-r2qj"}],"sources":{"cve":[{"id":"CVE-2022-24990","description":"TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending \"User-Agent: TNAS\" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.","status":"published","published":"2023-02-07T00:00:00Z","modified":"2025-10-21T23:15:27.378Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:34:34.940806Z"}],"euvd":[{"id":"EUVD-2022-29737","description":"TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending \"User-Agent: TNAS\" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.","status":"published","published":"2023-02-07T00:00:00Z","modified":"2025-10-21T23:15:27Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2023-02-10","updated_at":"2026-11-02T20:31:26.48918Z"}],"ghsa":[{"id":"GHSA-hp68-7f8q-r2qj","title":"TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative...","description":"TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending \"User-Agent: TNAS\" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.","status":"published","published":"2023-02-07T18:30:16Z","modified":"2025-10-22T00:32:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:04:06.493434Z"}],"kev":[{"id":"CVE-2022-24990","title":"TerraMaster OS Remote Command Execution Vulnerability","description":"TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.","cwes":["CWE-306"],"kev":{"date_added":"2023-02-10","due_date":"2023-03-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2022-24990","description":"TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending \"User-Agent: TNAS\" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.","status":"published","published":"2023-02-07T18:15:09.1Z","modified":"2026-06-17T04:32:54.773Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:07:36.026349Z"}]}}