CVE-2022-24990

HighCVSS 7.5/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://forum.terra-master.com/en/viewforum.php?f=28Issue Tracking, Release Notes
https://github.com/0xf4n9x/CVE-2022-24990Exploit, Third Party Advisory
https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/Exploit, Third Party Advisory
https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732Third Party Advisory
http://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://forum.terra-master.com/en/viewforum.php?f=28Issue Tracking, Release Notes
https://github.com/0xf4n9x/CVE-2022-24990Exploit, Third Party Advisory
https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/Exploit, Third Party Advisory
https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24990US Government Resource

Timeline

Published: Feb 7, 2023
Last modified: Jun 17, 2026
Added to CISA KEV: Feb 10, 2023
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-249927.5A vulnerability in the component process.php of QR Code Generator v5.2.7 allows attackers to perform directory traversal.CVE-2022-249959.8Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetSysTime. This vulnerability allows attackers to CVE-2022-249997.5qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express applicat CVE-2022-25005.4A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior CVE-2022-250039.8Hospital Patient Record Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in /admin/doctor CVE-2022-250049.8Hospital Patient Record Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in /admin/doctor CVE-2022-250088.8totolink EX300_v2 V4.0.3c.140_B20210429 and EX1200T V4.1.2cu.5230_B20210706 does not contain an authentication mechanism.CVE-2022-25017.5An improper access control issue in GitLab EE affecting all versions from 12.0 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2 CVE-2022-250109.1The component /rootfs in RageFile of Stepmania v5.1b2 and below allows attackers access to the entire file system.CVE-2022-250125.5Argus Surveillance DVR v4.0 employs weak password encryption.CVE-2022-250136.1Ice Hrm 30.0.0.OS was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the "key" and "fm" parameters CVE-2022-250146.1Ice Hrm 30.0.0.OS was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "m" parameter in the Dashboard of t