Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2018-9080

Iomega and LenovoEMC NAS Web UI Vulnerabilities

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
lenovo

Description

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, by setting the Iomega cookie to a known value before logging into the NAS's web application, the NAS will not provide the user a new cookie value. This allows an attacker who knows the cookie's value to compromise the user's session.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Lenovo Group LTD Iomega StorCenter

  • 4.1.402.34662 to ≤ 4.1.402.34662affected

Lenovo Group LTD LenovoEMC

  • 4.1.402.34662 to ≤ 4.1.402.34662affected

Lenovo Group LTD EZ Media and Backup Center

  • 4.1.402.34662 to ≤ 4.1.402.34662affected

References