High severity · published Feb 7, 2023
CVE-2022-24990
TerraMaster OS Remote Command Execution Vulnerability
RansomwareIn wildKEV
7.5
CVSS
83.2%
EPSS
Yes
On KEV
Description
TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)83.2% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Feb 10, 2023
Federal remediation dueMar 3, 2023
Ransomware campaign useKnown
Affected products
Which versions
TO
Terramaster Operating System · Terra-master
before 4.2.31 · source: NVD
TO
TerraMaster OS · TerraMaster
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-24990
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-24990
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
forum.terra-master.com
https://forum.terra-master.com/en/viewforum.php?f=28
www.broadcom.com
https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732
github.com
https://github.com/0xf4n9x/CVE-2022-24990
octagon.net
https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/
packetstormsecurity.com
http://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html
More from Terramaster Operating System
9.8
CVE-2022-24989
TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the…
9.8
CVE-2020-35665
An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter in include/makecvs.php during CSV…
9.8
CVE-2018-13354
System command injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "Event" parameter
9.8
CVE-2018-13350
SQL injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute SQL queries via the "Event" parameter
9.8
CVE-2018-13338
System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "username" parameter during user creation