← Vulnerability Intelligence

CVE-2022-24990

High 7.5 Exploited in the wild (KEV) Used in ransomware campaigns

Confirmed active exploitation — CISA KEV catalog

Name
TerraMaster OS Remote Command Execution Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Apply updates per vendor instructions.

Description

TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.

Metrics

CVSS 3.1
7.5 (HIGH) Score source: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS — exploit probability
83% (percentile: 100) as of 2 November 2026
CWE
CWE-306

Affected products

terra-master: terramaster operating system; terra-master: f2-210; terra-master: f2-221; terra-master: f2-223; terra-master: f2-422; terra-master: f2-423; terra-master: f4-421; terra-master: f4-422; terra-master: f4-423; terra-master: f5-221; terra-master: f5-422; terra-master: t12-423; terra-master: t12-450; terra-master: t6-423; terra-master: t9-423

References