CVE-2022-24990: TerraMaster NAS missing authentication exposes admin password

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated remote disclosure of the administrative password with confirmed exploitation and ransomware use in CISA KEV.

What it is

TerraMaster NAS 4.2.29 and earlier fails to require authentication on module/api.php?mobile/webNasIPS, allowing a remote attacker who sends a 'User-Agent: TNAS' header to read the administrative password from the PWD field in the response. The exposed credentials give full administrative control of the NAS, and the flaw is tracked in CISA KEV with known ransomware campaign use.

Impact

An unauthenticated attacker obtains the administrative password, enabling full control of the NAS including data access, configuration changes and further compromise. CISA records known ransomware campaign use tied to this vulnerability.

Attack surface

Reachable over the network via HTTP requests to module/api.php?mobile/webNasIPS with a crafted User-Agent header; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

CISA KEV lists it as actively exploited with known ransomware campaign use, and EPSS gives a 30-day probability of 0.83553 (99.668th percentile); multiple references are tagged Exploit.

What to do

• Apply the vendor update for TerraMaster TOS per vendor instructions; upgrade from 4.2.29 and earlier to a fixed release.
• Remove or block external exposure of the NAS management interface and api.php endpoints until patched.
• Rotate the administrative password and any reused credentials after patching, since the password may have been disclosed.
• Restrict access to the management interface to trusted networks or VPN and monitor for unauthorized administrative logins.

Detection

• Search web/proxy logs for requests to module/api.php?mobile/webNasIPS, especially with a User-Agent of TNAS.
• Alert on responses from that endpoint containing a PWD field or other credential material.
• Monitor for anomalous administrative logins or configuration changes on TerraMaster NAS devices.
• Use the referenced Broadcom attack signature (asid=33732) where available.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.