CVE-2022-24990 is a remote command execution vulnerability in TerraMaster TerraMaster OS. CISA added it to the Known Exploited Vulnerabilities catalogue on 10 February 2023, which means attackers have used it in real attacks. TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.
What this vulnerability means in practice
CVE-2022-24990 is dangerous because it turns a remote attack surface into command execution on the appliance itself. In a NAS or storage device, that can move the issue from a single exploited endpoint to broader access to files, backups, configuration, and any credentials or sessions stored on the system.
With unauthenticated remote command execution, the core security problem is not just code execution, but the collapse of trust at the perimeter. Once an attacker can run commands, they may be able to inspect the system, alter services, plant persistence, or use the device as a foothold into the rest of the environment.
How organisations assess exposure
Exposure review starts with an accurate asset inventory: where TerraMaster OS is deployed, which instances are internet-facing, and whether they are reachable through VPN, port forwarding, reverse proxies, or exposed management interfaces. The CVE Program and the NIST National Vulnerability Database are the authoritative places to confirm the record and track related metadata.
For practical triage, a vendor advisory is still the best source for product-specific version and remediation details. If an organisation cannot immediately confirm whether the device is vulnerable, it should assume the exposed management path is high risk until inventory, configuration, and vendor guidance have all been checked.
Containment and remediation
The safest response is to remove internet exposure first, then apply the vendor fix as soon as it is available for the exact build in use. If a patch cannot be applied immediately, compensating controls should reduce reachability and limit who can touch the management plane. A broader vulnerability programme should also prioritise known exploited issues like this one using exposure, exploitability, and business criticality together, as described in the Vulnerability Management Guide.
Where a device has been exposed, remediation is not only about closing the hole. Teams should also review whether the appliance stored administrative credentials, API tokens, SSH keys, backup secrets, or other sensitive material that may need to be rotated after containment.
Detection and post-patch review
Because this is remote command execution, defenders should treat unexpected process launches, shell activity, suspicious web requests, new scheduled tasks, and unexplained configuration changes as potential compromise indicators. The Web Application Attacks Guide is a useful companion for understanding how command injection-style weaknesses are commonly reached and abused.
After patching, organisations should not assume the device is clean. A post-patch review should check for persistence mechanisms, new local accounts, altered startup items, modified binaries, and any sign that the appliance was used to pivot elsewhere. If the system was internet-facing or stored privileged material, incident response should include a targeted compromise review of adjacent systems and credentials.
Risk and Threat Considerations
This vulnerability is especially concerning because an unauthenticated attacker can potentially convert a routine service exposure into full device compromise. For storage and backup appliances, that can threaten confidentiality, integrity, and availability at the same time, especially if the device is trusted by other internal systems.
Failure mechanism: The attacker abuses a remotely reachable command execution path to gain shell-level control, then uses that access to steal data, alter services, or stage further movement.
Impact: Organisations can lose control of the appliance, expose sensitive files and credentials, and inherit broader lateral-movement risk if the device is connected to internal systems or backup infrastructure.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5, NIST CSF 2.0 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | This CVE demands prioritised exposure tracking and remediation for a known exploited weakness. |
| Recommendation — Prioritise, patch, and verify remediation for exposed TerraMaster systems. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | RCE on a product requires disciplined flaw remediation and verification. |
| Recommendation — Remediate the TerraMaster flaw and verify the appliance is no longer exposed. | ||
| NIST CSF 2.0 | PR.IP-12 — Vulnerability Management | The term centers on identifying, prioritising, and remediating a known exploited vulnerability. |
| Recommendation — Track the affected asset, prioritise the KEV-listed flaw, and confirm closure. | ||
| OWASP ASVS | V15 — Secure Coding and Architecture | The vulnerability reflects an unsafe command-execution design that ASVS helps prevent and review. |
| Recommendation — Review command-execution pathways and remove unsafe server-side execution patterns. | ||
| MITRE ATT&CK | T1190 — Exploit Public-Facing Application | Unauthenticated remote command execution through an exposed service matches public-facing exploitation. |
| Recommendation — Hunt for exploitation of exposed management interfaces and follow-on execution. | ||
Practitioner Guidance
What to watch for: Treat any internet-facing TerraMaster OS instance as high priority until it is confirmed patched or isolated. If the appliance is business-critical, compensate with network restriction, management-plane isolation, and heightened monitoring rather than waiting for a maintenance window.
Governance implication: Ownership of exposed appliances should be explicit, because storage devices are often deployed locally but function as shared infrastructure. The accountable team should know who can update them, who validates exposure, and who signs off on continued operation after a known exploited flaw.