Live › vulnerability › CVE-2022-24990
Go to dashboardTerraMaster OS, the operating system on TerraMaster NAS devices, has a remote command execution flaw that needs no login. An unauthenticated attacker can run commands on the device, and CISA lists it as actively exploited, with ransomware use noted.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| TerraMaster TerraMaster OS | vendor | – | – |
| terra-master terramaster operating system | vendor | < 4.2.31 | 4.2.31 |
Unknown from the sources.
Apply the vendor update per CISA guidance; the fixed version is unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.
This page as .md · .json · in your agent: get_signal("CVE-2022-24990")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.