CVE-2022-24990: TerraMaster NAS admin-password disclosure, a step to full compromise
The short version: TerraMaster NAS devices have an information-disclosure flaw (CVE-2022-24990) that hands the administrative password to an unauthenticated request — and chained with a second flaw it becomes unauthenticated remote code execution. It's in CISA's KEV catalog and ransomware-associated. If you run an exposed TerraMaster NAS, patch and get it off the internet. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice (see below) |
| CVSS v3.1 (NVD) | 7.5 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CVSS (secondary CNA) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~84.1% · 99.7th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2023-03-03 |
| Known exploited? | Yes — KEV-listed and ransomware-associated |
| Vulnerability type | CWE-306 missing authentication → admin-password disclosure → (chained) remote command execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | TerraMaster NAS (TOS) 4.2.29 and earlier |
| Fixed in | TOS 4.2.31 (and later) |
What you need to know
CVE-2022-24990 is an information-disclosure flaw in TerraMaster's operating system (TOS). By sending a specific User-Agent header to an unauthenticated API endpoint, an attacker reads back sensitive fields — including the administrative password. On its own that's a serious leak; combined with a second flaw, public research chained it into unauthenticated remote command execution, which is why CISA's KEV entry describes it as remote command execution and why it's ransomware-associated.
This is a clean example of a bug whose practical severity outruns its base score:
- NVD scores it 7.5 (High) because, mechanically, it's "only" confidentiality — an information leak.
- In the real world it's a front door. Leaking the admin credential to an internet-facing storage device, then chaining to code execution, is how these appliances get ransomed.
How serious we see it
High — in practice, not on paper.
When the "information" disclosed is the administrator's password on an internet-facing NAS, and it chains to remote code execution, an information-disclosure bug behaves like a full compromise — which is exactly how it was used. We rate it by what it does, backed by its KEV listing and ransomware association. The bounded, reassuring part: it affects specific TOS builds (4.2.29 and earlier), the fix is published (4.2.31), and exposure is quick to confirm.
Recommendations
Straight from the vendor's guidance and CISA:
- Patch now. Upgrade TerraMaster TOS to 4.2.31 or later.
- Get it off the public internet. A NAS admin interface should not be internet-facing — restrict it to trusted networks or a VPN.
- Rotate credentials. Assume the admin password leaked if the device was exposed and unpatched — change it and any reused secrets.
- Hunt and respond. Review for unexpected admin logins, new accounts, or files; rebuild if compromise is found.
- Confirm your exposure first. Verify whether any TerraMaster NAS is reachable from the internet and which TOS build it runs.
How BreachRisk sees it
BreachRisk discovers internet-facing TerraMaster devices from the outside, fingerprints them, and flags exposure tied to this KEV-listed CVE so it rises to the top of your results. Where safe verification is possible, it issues a single bounded request to check whether the disclosure endpoint responds as vulnerable — a benign confirmation, not a credential grab. That's the difference between "this looks like a vulnerable TerraMaster" and "we confirmed the exposure."