{"cve":"CVE-2022-24990","epss":{"score":0.83043},"kev":{"dateAdded":"2023-02-10T00:00:00+00:00","dueDate":"2023-03-03T00:00:00+00:00"},"mitre":{"cpes":[],"created":"2023-02-07T00:00:00+00:00","description":"TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending \"User-Agent: TNAS\" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"mitre_repo_path":"cves/2022/24xxx/CVE-2022-24990.json","references":["http://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html","https://forum.terra-master.com/en/viewforum.php?f=28","https://github.com/0xf4n9x/CVE-2022-24990","https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/","https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732"],"title":null,"updated":"2025-10-21T23:15:27.378000+00:00","vendors":[],"weaknesses":[]},"nvd":{"cpes":["cpe:2.3:h:terra-master:f2-210:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:f2-221:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:f2-223:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:f2-422:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:f2-423:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:f4-421:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:f4-422:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:f4-423:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:f5-221:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:f5-422:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:t12-423:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:t12-450:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:t6-423:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:t9-423:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:t9-450:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:u12-322-9100:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:u12-423:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:u12-722-2224:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:u16-322-9100:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:u16-722-2224:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:u24-722-2224:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:u4-111:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:u4-211:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:u4-423:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:u8-111:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:u8-322-9100:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:u8-423:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:u8-522-9400:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:u8-722-2224:-:*:*:*:*:*:*:*","cpe:2.3:o:terra-master:terramaster_operating_system:*:*:*:*:*:*:*:*"],"created":"2023-02-07T18:15:09.100000+00:00","description":"TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending \"User-Agent: TNAS\" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"cvssV4_0":{}},"nvd_repo_path":"2022/CVE-2022-24990.json","references":["http://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html","https://forum.terra-master.com/en/viewforum.php?f=28","https://github.com/0xf4n9x/CVE-2022-24990","https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/","https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24990"],"title":null,"updated":"2026-06-17T04:32:54.773000+00:00","vendors":["terra-master","terra-master$PRODUCT$f2-210","terra-master$PRODUCT$f2-221","terra-master$PRODUCT$f2-223","terra-master$PRODUCT$f2-422","terra-master$PRODUCT$f2-423","terra-master$PRODUCT$f4-421","terra-master$PRODUCT$f4-422","terra-master$PRODUCT$f4-423","terra-master$PRODUCT$f5-221","terra-master$PRODUCT$f5-422","terra-master$PRODUCT$t12-423","terra-master$PRODUCT$t12-450","terra-master$PRODUCT$t6-423","terra-master$PRODUCT$t9-423","terra-master$PRODUCT$t9-450","terra-master$PRODUCT$terramaster_operating_system","terra-master$PRODUCT$u12-322-9100","terra-master$PRODUCT$u12-423","terra-master$PRODUCT$u12-722-2224","terra-master$PRODUCT$u16-322-9100","terra-master$PRODUCT$u16-722-2224","terra-master$PRODUCT$u24-722-2224","terra-master$PRODUCT$u4-111","terra-master$PRODUCT$u4-211","terra-master$PRODUCT$u4-423","terra-master$PRODUCT$u8-111","terra-master$PRODUCT$u8-322-9100","terra-master$PRODUCT$u8-423","terra-master$PRODUCT$u8-522-9400","terra-master$PRODUCT$u8-722-2224"],"weaknesses":["CWE-306"]},"opencve":{"changes":[{"created":"2025-02-03T15:15:00+00:00","data":[{"details":{"added":{"kev":{"dateAdded":"2023-02-10"},"ssvc":{"options":{"Automatable":"yes","Exploitation":"active","Technical Impact":"total"},"version":"2.0.3"}},"removed":{},"updated":{"cvssV3_1":{"new":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"old":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}}},"type":"metrics"}],"id":"f34f6316-db68-4d6c-ae67-ad0716ae2517"},{"created":"2025-10-21T19:30:00+00:00","data":[{"details":{"added":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24990"],"removed":[]},"type":"references"}],"id":"3fdd0fc3-f5a4-45e9-b0e4-bc6d7c322754"},{"created":"2025-10-21T20:30:00+00:00","data":[{"details":{"added":[],"removed":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24990"]},"type":"references"}],"id":"0b03b504-583e-44e6-a379-ecd4811e797f"},{"created":"2025-10-21T23:15:00+00:00","data":[{"details":{"added":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24990"],"removed":[]},"type":"references"}],"id":"cadcd53e-cec8-454c-b710-ed98c83aab2b"}],"cpes":{"data":["cpe:2.3:h:terra-master:f2-210:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:f2-221:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:f2-223:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:f2-422:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:f2-423:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:f4-421:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:f4-422:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:f4-423:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:f5-221:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:f5-422:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:t12-423:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:t12-450:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:t6-423:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:t9-423:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:t9-450:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:u12-322-9100:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:u12-423:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:u12-722-2224:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:u16-322-9100:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:u16-722-2224:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:u24-722-2224:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:u4-111:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:u4-211:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:u4-423:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:u8-111:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:u8-322-9100:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:u8-423:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:u8-522-9400:-:*:*:*:*:*:*:*","cpe:2.3:h:terra-master:u8-722-2224:-:*:*:*:*:*:*:*","cpe:2.3:o:terra-master:terramaster_operating_system:*:*:*:*:*:*:*:*"],"providers":["nvd"]},"created":{"data":"2023-02-07T00:00:00+00:00","provider":"mitre"},"description":{"data":"TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending \"User-Agent: TNAS\" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"provider":"vulnrichment"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.83043},"provider":"first"},"kev":{"data":{"dateAdded":"2023-02-10T00:00:00+00:00","dueDate":"2023-03-03T00:00:00+00:00"},"provider":"cisa"},"ssvc":{"data":{"options":{"Automatable":"yes","Exploitation":"active","Technical Impact":"total"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":null,"provider":null}},"references":{"data":["http://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html","https://forum.terra-master.com/en/viewforum.php?f=28","https://github.com/0xf4n9x/CVE-2022-24990","https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/","https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24990"],"providers":["mitre","nvd","vulnrichment"]},"title":{"data":null,"provider":null},"updated":{"data":"2025-11-07T19:02:38.613000+00:00","provider":"nvd"},"vendors":{"data":["terra-master","terra-master$PRODUCT$f2-210","terra-master$PRODUCT$f2-221","terra-master$PRODUCT$f2-223","terra-master$PRODUCT$f2-422","terra-master$PRODUCT$f2-423","terra-master$PRODUCT$f4-421","terra-master$PRODUCT$f4-422","terra-master$PRODUCT$f4-423","terra-master$PRODUCT$f5-221","terra-master$PRODUCT$f5-422","terra-master$PRODUCT$t12-423","terra-master$PRODUCT$t12-450","terra-master$PRODUCT$t6-423","terra-master$PRODUCT$t9-423","terra-master$PRODUCT$t9-450","terra-master$PRODUCT$terramaster_operating_system","terra-master$PRODUCT$u12-322-9100","terra-master$PRODUCT$u12-423","terra-master$PRODUCT$u12-722-2224","terra-master$PRODUCT$u16-322-9100","terra-master$PRODUCT$u16-722-2224","terra-master$PRODUCT$u24-722-2224","terra-master$PRODUCT$u4-111","terra-master$PRODUCT$u4-211","terra-master$PRODUCT$u4-423","terra-master$PRODUCT$u8-111","terra-master$PRODUCT$u8-322-9100","terra-master$PRODUCT$u8-423","terra-master$PRODUCT$u8-522-9400","terra-master$PRODUCT$u8-722-2224"],"providers":["nvd"]},"weaknesses":{"data":["CWE-306"],"providers":["nvd","vulnrichment"]}},"vulnrichment":{"cpes":[],"created":"2023-02-07T00:00:00+00:00","description":"TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending \"User-Agent: TNAS\" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssV4_0":{},"kev":{"dateAdded":"2023-02-10"},"ssvc":{"options":{"Automatable":"yes","Exploitation":"active","Technical Impact":"total"},"version":"2.0.3"}},"references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24990"],"title":null,"updated":"2025-02-03T14:16:59.139000+00:00","vendors":[],"vulnrichment_repo_path":"2022/24xxx/CVE-2022-24990.json","weaknesses":["CWE-306"]}}