PatchSiren

PatchSiren cyber security CVE debrief

CVE-2022-24990 TerraMaster CVE debrief

CVE-2022-24990 is a TerraMaster OS remote command execution vulnerability that CISA added to its Known Exploited Vulnerabilities catalog on 2023-02-10. The KEV metadata marks the issue as having known ransomware campaign use, so TerraMaster OS deployments should be treated as a high-priority remediation item.

Vendor
TerraMaster
Product
TerraMaster OS
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2023-02-10
Original CVE updated
2023-02-10
Advisory published
2023-02-10
Advisory updated
2023-02-10

Who should care

TerraMaster OS administrators, MSPs managing TerraMaster appliances, and incident responders tracking KEV-listed vulnerabilities with ransomware exposure.

Technical summary

CISA's Known Exploited Vulnerabilities catalog lists CVE-2022-24990 as a TerraMaster OS remote command execution vulnerability, with dateAdded 2023-02-10 and dueDate 2023-03-03. The supplied metadata also marks known ransomware campaign use as "Known" and points to vendor update instructions. No CVSS score is provided in the supplied corpus.

Defensive priority

High. A KEV listing plus known ransomware campaign use means remediation should be treated as urgent, especially for systems that are difficult to isolate or replace.

Recommended defensive actions

  • Apply TerraMaster's update guidance as soon as possible; CISA's KEV entry explicitly says to apply updates per vendor instructions.
  • Inventory TerraMaster OS instances so you can confirm which systems are affected and which have been remediated.
  • Prioritize remediation for systems that are externally reachable or otherwise exposed to untrusted networks.
  • Verify that patching or compensating controls were completed by the CISA due date of 2023-03-03, or as soon as possible if that date was missed.
  • Increase monitoring for unusual administrative activity and other signs of unauthorized remote command execution on TerraMaster OS systems.

Evidence notes

The supplied source corpus is limited to official and authoritative metadata: CISA's KEV entry, the CVE record, and the NVD detail page. Those sources identify the issue as a TerraMaster OS remote command execution vulnerability, show a KEV dateAdded of 2023-02-10 and dueDate of 2023-03-03, and mark known ransomware campaign use as "Known". No CVSS score or exploit walkthrough is present in the supplied corpus, so this debrief avoids unsupported detail.

Sources and references

Verified primary and authoritative sources

  • CVE-2022-24990 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2022-24990

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2022-24990 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2022-24990

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.