CVE-2022-24990: TerraMaster OS Remote Command Execution Vulnerability

CVE-2022-24990 is a remote command execution vulnerability in TerraMaster OS that lets an unauthenticated user run commands on the target system. It matters because successful abuse can give attackers full control of the device, and this vulnerability has been used in ransomware campaigns. Teams that run TerraMaster storage appliances should treat it as high priority and confirm all details against the vendor advisory.

CISA lists the required action as applying updates per the vendor’s instructions. Public detail on exact affected builds is limited, so inventory and remediation must be validated against the official advisory for TerraMaster OS.

How it works

The flaw is classified as CWE-306, Missing Authentication for Critical Function. In this class of weakness, a sensitive operation that should require authentication can be reached without any credentials. An unauthenticated remote attacker can therefore invoke the vulnerable function and cause the system to execute arbitrary commands under the privileges of the TerraMaster OS process.

Because no authentication is enforced, the attacker does not need a valid account or session. Exploitation typically involves sending crafted requests to the exposed management interface of the appliance. Exact request formats and parameters are not described here; defenders should obtain those details only from the vendor advisory or trusted analysis that cites it. Once command execution is achieved, the attacker can install malware, create backdoors, or prepare the system for ransomware deployment—activity that has already been observed with this CVE.

Am I affected? How to find it in your systems

TerraMaster OS runs on TerraMaster network-attached storage (NAS) appliances commonly used for file sharing, backups, and media storage in small-to-medium environments. These devices are often reachable from the internal network and sometimes from the internet if remote-access features are enabled.

• Inventory every TerraMaster appliance by querying asset-management systems, DHCP leases, or network scans for devices that identify as TerraMaster or that expose the vendor’s management ports.
• Log into each device’s web console or use any available CLI/API to record the exact TerraMaster OS version string. Compare that version against the list of fixed releases published in the vendor advisory; do not rely on version numbers from secondary sources.
• Check whether the management interface is exposed beyond the intended administrative network. Look for open ports associated with the web UI or remote-access services.
• Review authentication and access logs for unexpected unauthenticated requests or command-execution artifacts. Signs of exploitation may include sudden creation of new administrative accounts, unexpected processes, or outbound connections that do not match normal backup or sync traffic. Correlate these with any ransomware-related indicators already known for this CVE.

If the version cannot be confirmed or the advisory is unavailable, assume the device is vulnerable until proven otherwise and isolate it.

How to remediate

The primary remediation is to apply the vendor-supplied update that addresses CVE-2022-24990. Follow the installation steps exactly as documented by TerraMaster; CISA’s required action is simply “Apply updates per vendor instructions.” After patching, reboot if required and re-verify the version string.

• Change all administrative credentials and revoke any temporary or shared accounts that may have been used during the incident window.
• Disable unnecessary remote-access features and restrict the management interface to a dedicated administrative VLAN or jump-host network.
• Enable and retain detailed audit logging for authentication events and system commands so future anomalies can be detected quickly.
• Confirm that any third-party monitoring or backup agents running on the appliance are also updated and that their credentials have been rotated.

Document the patch date and version for compliance and for any subsequent forensic review.

If you can't patch immediately

When an immediate update is not possible, apply compensating controls that reduce the attack surface of this unauthenticated command-execution class.

• Segment the appliance so that only trusted administrative hosts can reach the management interface; block all other internal and external traffic with firewall rules or network ACLs.
• If a web application firewall or reverse proxy sits in front of the device, create temporary virtual-patch rules that drop requests matching known patterns for the vulnerability (obtain those patterns from the vendor or a trusted source that cites the advisory).
• Disable any optional services or remote-access modules that are not strictly required for business operations.
• Increase monitoring: alert on any unauthenticated access attempts, unusual process spawning, or outbound connections from the appliance. Feed these alerts into the security operations workflow for rapid triage.
• Consider taking the device offline for non-critical workloads until the patch can be applied, especially if it stores sensitive data or is internet-facing.

These measures do not eliminate the vulnerability; they only buy time until the official update can be installed.

If your data may have been exposed

Actively exploited vulnerabilities of this type frequently lead to data theft or ransomware encryption. If the appliance was reachable and unpatched during the period of known exploitation, treat any data stored on it as potentially compromised. Rotate credentials for accounts that had access to the device, review backup integrity, and follow your incident-response plan for containment and recovery. You can also run a free exposure scan of your email address against known breach data sets to determine whether associated credentials have already appeared in public dumps.