CVE-2022-24990 – CVE-2022-24990 is an unauthenticated remote cod... (How to Fix)

Q: What is the severity of CVE-2022-24990?

CVE-2022-24990 has a CVSS score of 7.5 (HIGH). CVE-2022-24990 is an unauthenticated remote code execution vulnerability in TerraMaster NAS devices. Attackers can discover the administrative password via a simple HTTP request and then execute arbitrary commands. This affects TerraMaster NAS users running vulnerable TOS versions.

📋 TL;DR

CVE-2022-24990 is an unauthenticated remote code execution vulnerability in TerraMaster NAS devices. Attackers can discover the administrative password via a simple HTTP request and then execute arbitrary commands. This affects TerraMaster NAS users running vulnerable TOS versions.

💻 Affected Systems

Products:

TerraMaster NAS devices running TOS

Versions: TOS 4.2.29 and earlier

Operating Systems: TerraMaster TOS (Linux-based NAS OS)

Default Config Vulnerable: ⚠️ Yes

Notes: All default configurations are vulnerable. No special configuration required for exploitation.

📦 What is this software?

Terramaster Operating System by Terra Master

View all CVEs affecting Terramaster Operating System →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise allowing attackers to execute arbitrary commands, steal data, install malware, or pivot to other network systems.

🟠

Likely Case

Attackers gain administrative access to the NAS, potentially accessing sensitive files, modifying configurations, or deploying ransomware.

🟢

If Mitigated

If properly segmented and monitored, impact limited to NAS device with potential data exposure but no lateral movement.

🌐 Internet-Facing: HIGH - Directly exploitable via HTTP without authentication from internet-facing interfaces.

🏢 Internal Only: HIGH - Even internally, any network access allows exploitation without credentials.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Multiple public exploits available. Simple HTTP request chain leads to RCE. No authentication required.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: TOS 4.2.30 or later

Vendor Advisory: https://forum.terra-master.com/en/viewforum.php?f=28

Restart Required: Yes

Instructions:

1. Backup NAS data. 2. Download latest TOS update from TerraMaster website. 3. Install via TOS web interface. 4. Reboot NAS after installation.

🔧 Temporary Workarounds

Block module/api.php access

linux

Restrict access to vulnerable endpoint via firewall or web server configuration

iptables -A INPUT -p tcp --dport 80 -m string --string "module/api.php" --algo bm -j DROP
iptables -A INPUT -p tcp --dport 443 -m string --string "module/api.php" --algo bm -j DROP

Network segmentation

all

Isolate TerraMaster NAS from internet and restrict internal network access

🧯 If You Can't Patch

Immediately disconnect vulnerable devices from internet and restrict to isolated VLAN
Implement strict network monitoring for exploitation attempts and change admin credentials

🔍 How to Verify

Check if Vulnerable:

Send HTTP GET request to http://[NAS_IP]/module/api.php?mobile/webNasIPS with User-Agent: TNAS header. If response contains PWD field with password, device is vulnerable.

Check Version:

Check TOS version in web interface under Control Panel > General Settings or via SSH: cat /etc/version

Verify Fix Applied:

After update, repeat vulnerable check. Should return error or no PWD field. Verify TOS version is 4.2.30 or higher.

📡 Detection & Monitoring

Log Indicators:

HTTP requests to /module/api.php with mobile/webNasIPS parameter
Requests with User-Agent: TNAS header
Unusual command execution or file access patterns

Network Indicators:

HTTP GET requests to /module/api.php?mobile/webNasIPS
Subsequent requests using discovered credentials
Outbound connections from NAS to suspicious IPs

SIEM Query:

source="web_logs" AND uri="/module/api.php" AND query="mobile/webNasIPS" OR user_agent="TNAS"

📊 Metadata

CVE ID: CVE-2022-24990

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE: CWE-306

Published: February 7, 2023

Last Updated: November 7, 2025

🔗 References

http://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html Exploit,Third Party Advisory,VDB Entry
https://forum.terra-master.com/en/viewforum.php?f=28 Issue Tracking,Release Notes
https://github.com/0xf4n9x/CVE-2022-24990 Exploit,Third Party Advisory
https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/ Exploit,Third Party Advisory
https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732 Third Party Advisory
http://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html Exploit,Third Party Advisory,VDB Entry
https://forum.terra-master.com/en/viewforum.php?f=28 Issue Tracking,Release Notes
https://github.com/0xf4n9x/CVE-2022-24990 Exploit,Third Party Advisory
https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/ Exploit,Third Party Advisory
https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732 Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24990 US Government Resource

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-24990, you might also want to check these: