Cybersecurity firm Octagon Networks has detected critical security vulnerabilities on TerraMaster network-attached storage (TNAS) devices that can be exploited to remotely execute code with high privileges (RCE) on target systems.
The vulnerabilities are contained in TerraMaster’s operating system, TOS, which allows storage management, application installation, and data backup. The chain needs no authentication. A remote attacker only needs network access to the device’s web interface.
The details of these security vulnerabilities are as follows:
- The vulnerability tracked by code CVE-2022-24990 exists due to an information leak in a component named “webNasIPS”. As a result, a remote threat actor can access the device firmware version, IP, MAC address, and admin password hash through the vulnerability.
- The security vulnerability tracked by code CVE-2022-24989 exists due to a command injection error in a PHP module named “createRaid”. By combining the two vulnerabilities, threat actors can send a tailored command to execute remote code.
An increase is observed in Ransomware attacks carried out through existing security vulnerabilities on NAS devices. TerraMaster fixed both flaws in TOS 4.2.31. Users should upgrade to TOS 4.2.31 or later and avoid exposing the NAS management interface directly to the internet.
CISA added CVE-2022-24990 to its Known Exploited Vulnerabilities catalog on 10 February 2023 and lists it as used in ransomware campaigns.