CVE-2022-24990: TerraMaster OS Remote Command Execution Vulnerability

High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2023-02-10. EPSS: 83.2% chance of exploitation in the next 30 days.

TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.

Affected products

• TerraMaster TerraMaster Operating System: before 4.2.31 (fixed in 4.2.31)

Published 2023-02-07. Last modified 2026-06-17.