TerraMaster NAS Security Guide: the 2022 Unauthenticated RCE Chain and TOS Lockdown

TerraMaster joined the DeadBolt casualty list in early 2022, and researchers at Octagon Networks disclosed a serious chain in TOS the same season: an information leak (CVE-2022-24990, webNasIPS exposing the admin password hash) chained with a command injection (CVE-2022-24989, createRaid) gave unauthenticated root RCE to anyone who knew the IP. TOS 4.2.30 (March 2022) fixed both and the DeadBolt-related flaw.

TOS lockdown

1. TOS ≥ 4.2.30 (and current since) — if you're on anything older with WAN exposure, treat the box as compromised.
2. No forwarded 8181 (TOS admin port); use TerraMaster's remote access or VPN instead.
3. TOS Snapshot on; Duple Backup to a second box or USB.
4. Disable SSH/Telnet unless needed (TOS 4.2.30+ added PAM auth hardening for these services — one more reason to be current).

Full steps: 12-step checklist. Hit? Recovery guide.

How bad was the TerraMaster 2022 vulnerability?

Severe: chaining CVE-2022-24990 (info leak incl. admin password hash) with CVE-2022-24989 (command injection) yielded unauthenticated root code execution from just the device IP. Patched in TOS 4.2.30 — if your TOS is older and was internet-facing, assume compromise and rebuild.

Did TerraMaster get DeadBolt too?

Yes — TerraMaster confirmed DeadBolt infections and shipped the fix in the same TOS 4.2.30 release ('Fixed a security vulnerability related to the Deadbolt ransomware attack').