Vulnerability Intelligence Report
TerraMaster OS Remote Command Execution Vulnerability
CVE-2022-24990
TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.
CISA KEV
Nuclei Template
SSVC: Active Exploitation
Automatable
CVSS Base Score
9.8
CRITICAL
Exploitability:3.9
Impact Score:5.9
EPSS Probability:84.05%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-306 ↗CWE-306 Missing Authentication for Critical Function
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| terra-master | terramaster_operating_system | all |
| terra-master | f2-210 | all |
| terra-master | f2-221 | all |
| terra-master | f2-223 | all |
| terra-master | f2-422 | all |
| terra-master | f2-423 | all |
| terra-master | f4-421 | all |
| terra-master | f4-422 | all |
| terra-master | f4-423 | all |
| terra-master | f5-221 | all |
| terra-master | f5-422 | all |
| terra-master | t12-423 | all |
| terra-master | t12-450 | all |
| terra-master | t6-423 | all |
| terra-master | t9-423 | all |
| terra-master | t9-450 | all |
| terra-master | u12-322-9100 | all |
| terra-master | u12-423 | all |
| terra-master | u12-722-2224 | all |
| terra-master | u16-322-9100 | all |
| terra-master | u16-722-2224 | all |
| terra-master | u24-722-2224 | all |
| terra-master | u4-111 | all |
| terra-master | u4-211 | all |
| terra-master | u4-423 | all |
| terra-master | u8-111 | all |
| terra-master | u8-322-9100 | all |
| terra-master | u8-423 | all |
| terra-master | u8-522-9400 | all |
| terra-master | u8-722-2224 | all |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
CISA KEV
ACTIVE IN CATALOG
Nuclei Template
SCANNER AVAILABLE
EPSS Score
84.050%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2022-02-14T00:00:00 |
| Published | 2023-02-07T00:00:00 |
| Last Updated | 2025-10-21T23:15:27 |
Community Chatter & Buzz