CVE-2022-24990 TerraMaster OS Remote Command Execution

Exploited in the wild Critical 9.8 Published 7 Feb 2023 Updated 21 Oct 2025

Remote attackers can discover the administrative password by sending a specific User-Agent header to the NAS API, leading to full device compromise.

Exploited in the wild: Since 10 Feb 2023
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-24990?

CVE-2022-24990 is a critical vulnerability in n/a, published on 7 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.

Weakness: CWE-306

Which versions are affected by CVE-2022-24990?

It affects 1 product.

Products include Terra-Master Terramaster Operating System.

How do I fix CVE-2022-24990?

No fix has been published for CVE-2022-24990 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 Mar 2023.

Is CVE-2022-24990 being exploited?

Yes. Attackers have exploited CVE-2022-24990 in the wild since at least 10 Feb 2023, including in ransomware campaigns.

Public exploit code: 1 Metasploit module, 1 Nuclei template and 6 proofs of concept on GitHub.

Sources

Also known as GHSA-hp68-7f8q-r2qj.