Critical · published February 7, 2023
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.7th percentile for exploit probability.
🚨 A remote attacker can snag your admin password just by sending a simple request with 'User-Agent: TNAS'! That's like leaving your front door wide open with a welcome mat that says 'please help yourself!' 🔥 Think of it like a restaurant where the waiter mistakenly leaves the secret recipe book on the counter, accessible to anyone in the dining area. The attacker just needs to ask for it to get all the juicy details! This vulnerability means an attacker could easily retrieve your administrative password, leading to total control over your TerraMaster NAS. If exploited, they could access sensitive data, modify settings, or even take it offline completely! This is absolutely devastating for your data security.
Think of it like a restaurant where the waiter mistakenly leaves the secret recipe book on the counter, accessible to anyone in the dining area. The attacker just needs to ask for it to get all the juicy details! CVE-2022-24990 allows remote attackers to discover the admin password by sending a specific User-Agent header to a vulnerable endpoint, exposing the PWD field in the response. This design flaw in TerraMaster NAS versions 4.2.29 and earlier is a significant risk.
This vulnerability means an attacker could easily retrieve your administrative password, leading to total control over your TerraMaster NAS. If exploited, they could access sensitive data, modify settings, or even take it offline completely! This is absolutely devastating for your data security. Immediate action is crucial! Upgrade your TerraMaster NAS to version 4.2.30 or later to patch this vulnerability. Also, consider changing your admin password to a strong, unique one to bolster security. 🛡️ You've got this! Follow these steps, and you'll secure your NAS in no time. Security hero status: activated! 🌟