Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2018-9075

Iomega and LenovoEMC NAS Web UI Vulnerabilities

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
lenovo

Description

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when joining a PersonalCloud setup, an attacker can craft a command injection payload using backtick "``" characters in the client:password parameter. As a result, arbitrary commands may be executed as the root user. The attack requires a value __c and iomega parameter.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Lenovo Group LTD Iomega StorCenter

  • 4.1.402.34662 to ≤ 4.1.402.34662affected

Lenovo Group LTD LenovoEMC

  • 4.1.402.34662 to ≤ 4.1.402.34662affected

Lenovo Group LTD EZ Media and Backup Center

  • 4.1.402.34662 to ≤ 4.1.402.34662affected

References