cve-2022-24990

HIGH CVSS 7.5 opencve
Description

TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.

Timeline
Published
2023-02-07 18:15 UTC
Last Modified
2026-06-17
CVSS Details

CVSS details not available.

Affected Products

No product information available.

Weaknesses (CWE)
CWE-306
CVSS metrics
Version Base Severity Vector Exploitability Impact Source
3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N nvd
3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H opencve
3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vulnrichment
References

No references available.

Linked Vulnerabilities

No linked vulnerabilities found.

{
  "cve": "CVE-2022-24990",
  "epss": {
    "score": 0.83043
  },
  "kev": {
    "dateAdded": "2023-02-10T00:00:00+00:00",
    "dueDate": "2023-03-03T00:00:00+00:00"
  },
  "mitre": {
    "cpes": [],
    "created": "2023-02-07T00:00:00+00:00",
    "description": "TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending \"User-Agent: TNAS\" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {}
    },
    "mitre_repo_path": "cves/2022/24xxx/CVE-2022-24990.json",
    "references": [
      "http://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html",
      "https://forum.terra-master.com/en/viewforum.php?f=28",
      "https://github.com/0xf4n9x/CVE-2022-24990",
      "https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/",
      "https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732"
    ],
    "title": null,
    "updated": "2025-10-21T23:15:27.378000+00:00",
    "vendors": [],
    "weaknesses": []
  },
  "nvd": {
    "cpes": [
      "cpe:2.3:h:terra-master:f2-210:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:terra-master:f2-221:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:terra-master:f2-223:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:terra-master:f2-422:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:terra-master:f2-423:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:terra-master:f4-421:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:terra-master:f4-422:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:terra-master:f4-423:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:terra-master:f5-221:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:terra-master:f5-422:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:terra-master:t12-423:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:terra-master:t12-450:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:terra-master:t6-423:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:terra-master:t9-423:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:terra-master:t9-450:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:terra-master:u12-322-9100:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:terra-master:u12-423:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:terra-master:u12-722-2224:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:terra-master:u16-322-9100:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:terra-master:u16-722-2224:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:terra-master:u24-722-2224:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:terra-master:u4-111:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:terra-master:u4-211:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:terra-master:u4-423:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:terra-master:u8-111:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:terra-master:u8-322-9100:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:terra-master:u8-423:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:terra-master:u8-522-9400:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:terra-master:u8-722-2224:-:*:*:*:*:*:*:*",
      "cpe:2.3:o:terra-master:terramaster_operating_system:*:*:*:*:*:*:*:*"
    ],
    "created": "2023-02-07T18:15:09.100000+00:00",
    "description": "TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending \"User-Agent: TNAS\" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 7.5,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
      },
      "cvssV4_0": {}
    },
    "nvd_repo_path": "2022/CVE-2022-24990.json",
    "references": [
      "http://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html",
      "https://forum.terra-master.com/en/viewforum.php?f=28",
      "https://github.com/0xf4n9x/CVE-2022-24990",
      "https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/",
      "https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732",
      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24990"
    ],
    "title": null,
    "updated": "2026-06-17T04:32:54.773000+00:00",
    "vendors": [
      "terra-master",
      "terra-master$PRODUCT$f2-210",
      "terra-master$PRODUCT$f2-221",
      "terra-master$PRODUCT$f2-223",
      "terra-master$PRODUCT$f2-422",
      "terra-master$PRODUCT$f2-423",
      "terra-master$PRODUCT$f4-421",
      "terra-master$PRODUCT$f4-422",
      "terra-master$PRODUCT$f4-423",
      "terra-master$PRODUCT$f5-221",
      "terra-master$PRODUCT$f5-422",
      "terra-master$PRODUCT$t12-423",
      "terra-master$PRODUCT$t12-450",
      "terra-master$PRODUCT$t6-423",
      "terra-master$PRODUCT$t9-423",
      "terra-master$PRODUCT$t9-450",
      "terra-master$PRODUCT$terramaster_operating_system",
      "terra-master$PRODUCT$u12-322-9100",
      "terra-master$PRODUCT$u12-423",
      "terra-master$PRODUCT$u12-722-2224",
      "terra-master$PRODUCT$u16-322-9100",
      "terra-master$PRODUCT$u16-722-2224",
      "terra-master$PRODUCT$u24-722-2224",
      "terra-master$PRODUCT$u4-111",
      "terra-master$PRODUCT$u4-211",
      "terra-master$PRODUCT$u4-423",
      "terra-master$PRODUCT$u8-111",
      "terra-master$PRODUCT$u8-322-9100",
      "terra-master$PRODUCT$u8-423",
      "terra-master$PRODUCT$u8-522-9400",
      "terra-master$PRODUCT$u8-722-2224"
    ],
    "weaknesses": [
      "CWE-306"
    ]
  },
  "opencve": {
    "changes": [
      {
        "created": "2025-02-03T15:15:00+00:00",
        "data": [
          {
            "details": {
              "added": {
                "kev": {
                  "dateAdded": "2023-02-10"
                },
                "ssvc": {
                  "options": {
                    "Automatable": "yes",
                    "Exploitation": "active",
                    "Technical Impact": "total"
                  },
                  "version": "2.0.3"
                }
              },
              "removed": {},
              "updated": {
                "cvssV3_1": {
                  "new": {
                    "score": 9.8,
                    "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
                  },
                  "old": {
                    "score": 7.5,
                    "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
                  }
                }
              }
            },
            "type": "metrics"
          }
        ],
        "id": "f34f6316-db68-4d6c-ae67-ad0716ae2517"
      },
      {
        "created": "2025-10-21T19:30:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24990"
              ],
              "removed": []
            },
            "type": "references"
          }
        ],
        "id": "3fdd0fc3-f5a4-45e9-b0e4-bc6d7c322754"
      },
      {
        "created": "2025-10-21T20:30:00+00:00",
        "data": [
          {
            "details": {
              "added": [],
              "removed": [
                "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24990"
              ]
            },
            "type": "references"
          }
        ],
        "id": "0b03b504-583e-44e6-a379-ecd4811e797f"
      },
      {
        "created": "2025-10-21T23:15:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24990"
              ],
              "removed": []
            },
            "type": "references"
          }
        ],
        "id": "cadcd53e-cec8-454c-b710-ed98c83aab2b"
      }
    ],
    "cpes": {
      "data": [
        "cpe:2.3:h:terra-master:f2-210:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:terra-master:f2-221:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:terra-master:f2-223:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:terra-master:f2-422:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:terra-master:f2-423:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:terra-master:f4-421:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:terra-master:f4-422:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:terra-master:f4-423:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:terra-master:f5-221:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:terra-master:f5-422:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:terra-master:t12-423:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:terra-master:t12-450:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:terra-master:t6-423:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:terra-master:t9-423:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:terra-master:t9-450:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:terra-master:u12-322-9100:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:terra-master:u12-423:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:terra-master:u12-722-2224:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:terra-master:u16-322-9100:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:terra-master:u16-722-2224:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:terra-master:u24-722-2224:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:terra-master:u4-111:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:terra-master:u4-211:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:terra-master:u4-423:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:terra-master:u8-111:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:terra-master:u8-322-9100:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:terra-master:u8-423:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:terra-master:u8-522-9400:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:terra-master:u8-722-2224:-:*:*:*:*:*:*:*",
        "cpe:2.3:o:terra-master:terramaster_operating_system:*:*:*:*:*:*:*:*"
      ],
      "providers": [
        "nvd"
      ]
    },
    "created": {
      "data": "2023-02-07T00:00:00+00:00",
      "provider": "mitre"
    },
    "description": {
      "data": "TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending \"User-Agent: TNAS\" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.",
      "provider": "mitre"
    },
    "metrics": {
      "cvssV2_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_1": {
        "data": {
          "score": 9.8,
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        },
        "provider": "vulnrichment"
      },
      "cvssV4_0": {
        "data": {},
        "provider": null
      },
      "epss": {
        "data": {
          "score": 0.83043
        },
        "provider": "first"
      },
      "kev": {
        "data": {
          "dateAdded": "2023-02-10T00:00:00+00:00",
          "dueDate": "2023-03-03T00:00:00+00:00"
        },
        "provider": "cisa"
      },
      "ssvc": {
        "data": {
          "options": {
            "Automatable": "yes",
            "Exploitation": "active",
            "Technical Impact": "total"
          },
          "version": "2.0.3"
        },
        "provider": "vulnrichment"
      },
      "threat_severity": {
        "data": null,
        "provider": null
      }
    },
    "references": {
      "data": [
        "http://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html",
        "https://forum.terra-master.com/en/viewforum.php?f=28",
        "https://github.com/0xf4n9x/CVE-2022-24990",
        "https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/",
        "https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732",
        "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24990"
      ],
      "providers": [
        "mitre",
        "nvd",
        "vulnrichment"
      ]
    },
    "title": {
      "data": null,
      "provider": null
    },
    "updated": {
      "data": "2025-11-07T19:02:38.613000+00:00",
      "provider": "nvd"
    },
    "vendors": {
      "data": [
        "terra-master",
        "terra-master$PRODUCT$f2-210",
        "terra-master$PRODUCT$f2-221",
        "terra-master$PRODUCT$f2-223",
        "terra-master$PRODUCT$f2-422",
        "terra-master$PRODUCT$f2-423",
        "terra-master$PRODUCT$f4-421",
        "terra-master$PRODUCT$f4-422",
        "terra-master$PRODUCT$f4-423",
        "terra-master$PRODUCT$f5-221",
        "terra-master$PRODUCT$f5-422",
        "terra-master$PRODUCT$t12-423",
        "terra-master$PRODUCT$t12-450",
        "terra-master$PRODUCT$t6-423",
        "terra-master$PRODUCT$t9-423",
        "terra-master$PRODUCT$t9-450",
        "terra-master$PRODUCT$terramaster_operating_system",
        "terra-master$PRODUCT$u12-322-9100",
        "terra-master$PRODUCT$u12-423",
        "terra-master$PRODUCT$u12-722-2224",
        "terra-master$PRODUCT$u16-322-9100",
        "terra-master$PRODUCT$u16-722-2224",
        "terra-master$PRODUCT$u24-722-2224",
        "terra-master$PRODUCT$u4-111",
        "terra-master$PRODUCT$u4-211",
        "terra-master$PRODUCT$u4-423",
        "terra-master$PRODUCT$u8-111",
        "terra-master$PRODUCT$u8-322-9100",
        "terra-master$PRODUCT$u8-423",
        "terra-master$PRODUCT$u8-522-9400",
        "terra-master$PRODUCT$u8-722-2224"
      ],
      "providers": [
        "nvd"
      ]
    },
    "weaknesses": {
      "data": [
        "CWE-306"
      ],
      "providers": [
        "nvd",
        "vulnrichment"
      ]
    }
  },
  "vulnrichment": {
    "cpes": [],
    "created": "2023-02-07T00:00:00+00:00",
    "description": "TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending \"User-Agent: TNAS\" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 9.8,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
      },
      "cvssV4_0": {},
      "kev": {
        "dateAdded": "2023-02-10"
      },
      "ssvc": {
        "options": {
          "Automatable": "yes",
          "Exploitation": "active",
          "Technical Impact": "total"
        },
        "version": "2.0.3"
      }
    },
    "references": [
      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24990"
    ],
    "title": null,
    "updated": "2025-02-03T14:16:59.139000+00:00",
    "vendors": [],
    "vulnrichment_repo_path": "2022/24xxx/CVE-2022-24990.json",
    "weaknesses": [
      "CWE-306"
    ]
  }
}
Enrichment data
EPSS
View JSON Download
CISA KEV
View JSON Download
Nuclei templates
View JSON Download
Aggregated bundle (all enrichments)
View JSON API Download bundle
View JSON API Download JSON