CyberSec.Space Logo
Back to CVE Browser

CVE-2022-24990

🔥 Known Exploited (CISA KEV)HIGH
7.5
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile0.00th
Published2023-02-07
Last Modified2026-06-17
Data SourcesNVDCISA KEV

Vulnerability Description

TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.

Affected Platforms (CPE)

💻
Terra Master

Terramaster Operating System

< 4.2.31

References & Advisories

🔗 http://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html
🔗 https://forum.terra-master.com/en/viewforum.php?f=28
🔗 https://github.com/0xf4n9x/CVE-2022-24990
🔗 https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/
🔗 https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732
🔗 http://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html
🔗 https://forum.terra-master.com/en/viewforum.php?f=28
🔗 https://github.com/0xf4n9x/CVE-2022-24990

Related Vulnerabilities

CVE-2026-400001.8

The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files...

CVE-2026-175237.8

A flaw was found in the kernel. An unprivileged local user can exploit this vulnerability to execute arbitrary code within the ker...

CVE-2026-148378.5

Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-pr...

CVE-2026-174978.3

NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary ar...