ACTIVELY EXPLOITED
CVE-2022-24990: TerraMaster OS Remote Command Execution Vulnerability
| Vendor | TerraMaster |
|---|---|
| Product | TerraMaster OS |
| Actively exploited | Yes |
| Added to CISA KEV | 10 Feb 2023 |
| CISA federal deadline | 3 Mar 2023 |
| Ransomware use | Known |
| Weakness (CWE) | CWE-306 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.
SOURCES
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.