Login Request a demo
Medium severity · published Sep 28, 2018
CVE-2018-9080
Iomega and LenovoEMC NAS Web UI Vulnerabilities
5.9
CVSS
0.7%
EPSS
No
On KEV
Description
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, by setting the Iomega cookie to a known value before logging into the NAS's web application, the NAS will not provide the user a new cookie value. This allows an attacker who knows the cookie's value to compromise the user's session.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
EZ Media and Backup Center · Lenovo Group LTD
4.1.402.34662 through 4.1.402.34662 · source: vendor
IS
Iomega StorCenter · Lenovo Group LTD
4.1.402.34662 through 4.1.402.34662 · source: vendor
LE
LenovoEMC · Lenovo Group LTD
4.1.402.34662 through 4.1.402.34662 · source: vendor
EM
EZ Media & Backup Center Firmware · Lenovo
4.1.402.34662; 4.1.402.34662 · source: NVD
IF
Ix2 Firmware · Lenovo
4.1.402.34662 · source: NVD
IF
Ix4-300d Firmware · Lenovo
4.1.402.34662 · source: NVD
PF
Px12-400r Firmware · Lenovo
4.1.402.34662 · source: NVD
PF
Px12-450r Firmware · Lenovo
4.1.402.34662 · source: NVD
PF
Px2-300d Firmware · Lenovo
4.1.402.34662 · source: NVD
PF
Px4-300d Firmware · Lenovo
4.1.402.34662 · source: NVD
PF
Px4-300r Firmware · Lenovo
4.1.402.34662 · source: NVD
PF
Px4-400d Firmware · Lenovo
4.1.402.34662 · source: NVD
Affected product
EM
EZ Media and Backup Center
Lenovo Group LTD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-9080
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-9080
Vendor Advisory
https://support.lenovo.com/us/en/solutions/LEN-24224
More from EZ Media and Backup Center
9.8
CVE-2018-9079
Iomega and LenovoEMC NAS Web UI Vulnerabilities
8.8
CVE-2018-9082
Iomega and LenovoEMC NAS Web UI Vulnerabilities
8.8
CVE-2018-9078
Iomega and LenovoEMC NAS Web UI Vulnerabilities
8.1
CVE-2018-9077
Iomega and LenovoEMC NAS Web UI Vulnerabilities
8.1
CVE-2018-9075
Iomega and LenovoEMC NAS Web UI Vulnerabilities