TerraMaster TOS 4.2.29 Unauthenticated Administrator Password Disclosure and Remote Code Execution (CVE-2022-24990)
Executive & SecOps Summary
SECOPS ASSESSMENTTerraMaster NAS devices running TOS (TerraMaster Operating System) version 4.2.29 and earlier
Unauthenticated remote attackers can retrieve the administrator password hash or plaintext by sending a crafted HTTP request, leading to complete device compromise
Immediately upgrade TOS to the latest secure version (4.2.30 or higher) and restrict external internet access to the NAS management interface
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official security patch by upgrading to TOS version 4.2.30 or higher. You can perform the update via the web-based control panel or manually download and apply the update package using the following commands:
# 1. Download the secure TOS update package (verify the link on the official portal)
wget https://download2.terra-master.com/TOS_S2.0_Update_TOS_4.2.30_2203011629.bz2
# 2. Verify the integrity of the downloaded package
sha256sum TOS_S2.0_Update_TOS_4.2.30_2203011629.bz2
# 3. Apply the update package through the TOS manual update interface2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict external access to the NAS management interface. Use a reverse proxy like Nginx to block unauthorized access to the vulnerable endpoint.
# Nginx configuration to block malicious requests targeting the vulnerable endpoint
server {
listen 80;
server_name nas.local;
# Block access to api.php when the TNAS User-Agent is detected
location ~* /module/api.php {
if ($http_user_agent ~* 'TNAS') {
return 403 'Access Denied';
}
# Restrict access to trusted internal IP ranges only
allow 192.168.1.0/24;
deny all;
}
}3. Log Audit & IoC Verification Commands
Inspect your web server access logs to identify potential exploitation attempts targeting the vulnerable API endpoint.
# Search for exploitation attempts in Nginx or Apache access logs
grep -i 'api.php?mobile/webNasIPS' /var/log/nginx/access.log | grep -i 'TNAS'
# Check the currently running TOS version on the device
cat /etc/tos_versionBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2022-24990) is caused by a missing authentication mechanism (CWE-306) within the mobile/webNasIPS API endpoint of the module/api.php component in TerraMaster TOS. The application fails to validate the authorization state of incoming requests to this endpoint. When a request containing a specific User-Agent header is received, the system mistakenly trusts the request and returns sensitive administrative credentials in the response body.
2. Exploitation Mechanics & Attack Scenario
An attacker sends a GET or POST request to the target NAS device at /module/api.php?mobile/webNasIPS with the HTTP header User-Agent: TNAS. Because of the lack of proper access control, the application processes the request and leaks the administrator credentials within the PWD field of the JSON response. Attackers can leverage this leaked credential to log in as an administrator or chain it with other vulnerabilities (such as PHP object instantiation) to achieve remote code execution (RCE).
3. Infrastructure & Business Impact
As this vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, it is actively being exploited in the wild. Successful exploitation allows attackers to gain full administrative control over the NAS device. This can lead to severe consequences, including unauthorized access to sensitive stored data, deployment of ransomware, lateral movement within the internal network, and recruitment of the device into malicious botnets.
Official Vendor Advisories & References
TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.
Frequently Asked SecOps Questions (CVE-2022-24990)
FAQQ1. How critical is CVE-2022-24990 and is it actively exploited in the wild?
CVE-2022-24990 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 83.2%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2022-24990?
Primary impacted vendors include terramaster across tos. Scope summary: All TerraMaster TOS versions 4.2.29 and prior (below TOS 4.2.30)
Q3. What temporary mitigations or workarounds exist for CVE-2022-24990 before patching?
[Mitigation] Immediately upgrade TOS to the latest secure version (4.2.30 or higher) and restrict external internet access to the NAS management interface Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2022-24990
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (terramaster)
View Category →Microsoft Office SharePoint Missing Authentication Privilege Escalation Vulnerability (CVE-2026-56164) Security Advisory
[Affected Scope] Microsoft Office SharePoint Server environments
Oracle PeopleSoft Enterprise PeopleTools Remote Code Execution and System Takeover Vulnerability (CVE-2026-35273)
[Affected Scope] Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62
Splunk Enterprise Unauthenticated Arbitrary File Creation and RCE via PostgreSQL Sidecar Service (CVE-2026-20253)
[Affected Scope] Splunk Enterprise versions 10.2.x below 10.2.4 and 10.0.x below 10.0.7 (versions 9.4 and earlier are unaffected)
Oracle E-Business Suite Payments File Transmission Authentication Bypass and Remote Code Execution (CVE-2026-46817)
[Affected Scope] Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, specifically the Oracle Payments (File Transmission) component
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.