# CVE-2022-24990: TerraMaster OS Remote Command Execution Vulnerability

Source: https://junglewise.ai/threats/cve-2022-24990-terramaster-os-remote-command-execution-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-02-10. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2022-24990 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2023-02-10

TerraMaster TOS (TerraMaster Operating System) contains a vulnerability that allows unauthenticated remote attackers to discover administrative passwords by sending a specific User-Agent header to a mobile API endpoint. This information disclosure can be leveraged to achieve remote command execution on the affected NAS device.

## Quick answers

**Is CVE-2022-24990 exploited in the wild?** Yes. CVE-2022-24990 is known to be exploited in the wild, first recorded on 10 February 2023. Treat it as urgent.

**How severe is CVE-2022-24990?** Critical severity, with a CVSS score of 9.8, published 10 February 2023.

**Which products and versions are affected?** TerraMaster TOS (TerraMaster Operating System) <= 4.2.29; TerraMaster NAS Hardware (F2-210, F2-221, F2-223, F2-422, F2-423, F4-421, F4-422, F4-423, F5-221, F5-422, T12-423, T12-450, T6-423, T9-423, T9-450, U12-322-9100, U12-423, U12-722-2224, U16-322-9100, U16-722-2224, U24-722-2224, U4-111, U4-211, U4-423, U8-111, U8-322-9100).

**Is there a fix for CVE-2022-24990?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2022-24990 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2022-24990?** Check whether you run TerraMaster OS. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- TerraMaster TOS (TerraMaster Operating System) <= 4.2.29
- TerraMaster NAS Hardware (F2-210, F2-221, F2-223, F2-422, F2-423, F4-421, F4-422, F4-423, F5-221, F5-422, T12-423, T12-450, T6-423, T9-423, T9-450, U12-322-9100, U12-423, U12-722-2224, U16-322-9100, U16-722-2224, U24-722-2224, U4-111, U4-211, U4-423, U8-111, U8-322-9100)

## Timeline

- 2022-03-07: disclosed: Initial public disclosure of the vulnerability details.
- 2023-02-10: kev added: Added to CISA's Known Exploited Vulnerabilities (KEV) Catalog.
- 2023-02-10: advisory: NVD publication date.