CVE-2022-24990

The vulnerability in the TerraMaster NAS operating system, specifically in versions 4.2.29 and earlier, arises from improper handling of user input in the API endpoint. By sending a specially crafted request with the "User-Agent: TNAS" header to the module/api.php?mobile/webNasIPS endpoint, an attacker can elicit a response that inadvertently reveals the administrative password stored in the PWD field. This flaw highlights a critical oversight in input validation and response management, as sensitive information is exposed without adequate authentication or authorization checks. The lack of security measures to obfuscate or encrypt the password further exacerbates the risk, allowing attackers to exploit this vulnerability with minimal effort.

Exploitation of this vulnerability can occur remotely, making it particularly concerning for organizations that rely on TerraMaster NAS devices for data storage and management. An attacker could leverage this weakness to gain unauthorized access to the administrative interface of the NAS, subsequently allowing them to manipulate settings, access sensitive data, or even deploy further attacks within the network. Scenarios could include an attacker targeting a specific organization known to use TerraMaster devices, or broader scans for vulnerable systems across the internet. Once the administrative password is obtained, the attacker could potentially pivot to other systems, escalating their access and impact.

The real-world implications of this vulnerability are significant, particularly for businesses that store sensitive information on their NAS devices. The exposure of administrative credentials can lead to data breaches, loss of intellectual property, and potential regulatory repercussions depending on the nature of the data compromised. Additionally, the reputational damage that could result from a successful attack can have long-lasting effects on customer trust and brand integrity. Organizations may face financial losses due to remediation efforts, legal fees, and potential fines imposed by regulatory bodies for failing to protect sensitive data adequately.

To detect and mitigate this vulnerability, organizations should implement several strategies. First, it is crucial to conduct regular security assessments and vulnerability scans to identify any instances of the affected TerraMaster NAS operating systems within the network. Monitoring network traffic for unusual patterns, such as requests to the vulnerable API endpoint, can also help identify potential exploitation attempts. Additionally, organizations should ensure that they are running the latest version of the TerraMaster operating system, as updates may include patches that address this vulnerability. Implementing network segmentation can further limit the exposure of NAS devices to the internet, reducing the attack surface.

In conclusion, the vulnerability present in the TerraMaster NAS operating system represents a significant risk to organizations utilizing this technology. The ease of exploitation and the potential for severe consequences necessitate immediate attention from cybersecurity teams. By adopting proactive detection and mitigation strategies, organizations can better safeguard their sensitive data and maintain the integrity of their IT infrastructure. Continuous monitoring and timely updates will be essential in defending against this and similar vulnerabilities in the future.

The CVSS score for CVE-2022-24990 has been revised upward from 7.5 to 9.8, reflecting a reassessment of the vulnerability’s criticality based on emerging evidence. This change coincides with the inclusion of the vulnerability in the Known Exploited Vulnerabilities (KEV) catalog, underscoring its active exploitation in the wild, including documented use by ransomware operators. CSURFACE threat intelligence has identified a steady presence of multiple publicly available proof-of-concept exploits, which lowers the barrier for adversaries to weaponize this flaw. Although the EPSS score remains stable at a high level, the KEV listing and ransomware association elevate the urgency for defenders to prioritize detection and response efforts. This recalibration signals that the threat posed by CVE-2022-24990 is both imminent and severe, increasing the likelihood of compromise in environments running vulnerable TerraMaster OS versions. Consequently, the overall risk rating for this vulnerability should be considered critical, with a heightened potential for impactful exploitation campaigns targeting exposed assets.

Update 2 — June 07, 2026

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting CVE-2022-24990, with telemetry indicating a significant uptick in adversary activity leveraging this vulnerability. This surge coincides with the emergence of multiple new proof-of-concept exploits publicly available on GitHub, broadening the attack surface and lowering the barrier to weaponization. The continued association of this vulnerability with ransomware operations underscores its attractiveness to threat actors seeking initial access or lateral movement within TerraMaster NAS environments. Although the EPSS score remains stable at an elevated level, the qualitative increase in detection frequency and exploit availability amplifies the urgency for defenders to monitor and respond to potential intrusions. Consequently, the threat level for CVE-2022-24990 should be reassessed as increasingly critical, reflecting both the heightened likelihood of exploitation and the expanding toolkit adversaries possess to capitalize on this flaw.

Update 3 — June 15, 2026

CSURFACE threat intelligence has detected a modest increase in activity related to CVE-2022-24990, with our telemetry indicating a slight rise in exploitation attempts targeting TerraMaster NAS devices. Despite a marginal decline in the EPSS score, the sustained presence of multiple publicly available proof-of-concept exploits continues to lower the barrier for adversaries, including ransomware operators, to leverage this vulnerability. This subtle uptick in detection frequency, combined with the persistent availability of exploit code, signals that threat actors remain actively interested in this flaw for initial access or lateral movement. Consequently, the threat level for CVE-2022-24990 remains critically high, underscoring the ongoing risk posed to affected environments and the necessity for vigilant monitoring.

Update 4 — July 05, 2026

CSURFACE threat intelligence has identified a marked escalation in detection activity related to CVE-2022-24990, indicating increased adversary engagement with this vulnerability. Although the official CVSS score has been revised downward to 7.5, reflecting a recalibration of the vulnerability’s impact parameters, the practical risk remains elevated due to the sustained availability of multiple proof-of-concept exploits and the integration of this flaw into automated attack frameworks, including Metasploit modules. Our telemetry confirms that threat actors, including ransomware affiliates, continue to leverage this vulnerability as a vector for initial access and lateral movement within TerraMaster NAS environments. The slight surge in exploitation attempts underscores persistent attacker interest and suggests that the vulnerability remains a viable target in the wild. Consequently, despite the CVSS adjustment, the overall threat level should be considered critically high, as the operational exploitation landscape has not diminished and may in fact be intensifying.

Update 5 — August 02, 2026

CSURFACE threat intelligence has identified a modest increase in exploitation attempts targeting CVE-2022-24990, reflecting sustained adversary interest despite a slight decline in the EPSS score. This persistence is underscored by the continued availability and dissemination of multiple proof-of-concept exploits on public repositories, which lowers the barrier for threat actors, including ransomware affiliates, to leverage this vulnerability for initial access and lateral movement within TerraMaster NAS environments. While the uptick in detection activity is not dramatic, it signals that the vulnerability remains actively targeted and operationally relevant. Consequently, defenders should recognize that the threat landscape surrounding CVE-2022-24990 remains dynamic and that the risk level continues to warrant a high priority designation due to ongoing exploitation potential and the involvement of financially motivated threat groups.