Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2018-9082

Iomega and LenovoEMC NAS Web UI Vulnerabilities

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
lenovo

Description

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the password changing functionality available to authenticated users does not require the user's current password to set a new one. As a result, attackers with access to the user's session tokens can change their password and retain access to the user's account

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Lenovo Group LTD Iomega StorCenter

  • 4.1.402.34662 to ≤ 4.1.402.34662affected

Lenovo Group LTD LenovoEMC

  • 4.1.402.34662 to ≤ 4.1.402.34662affected

Lenovo Group LTD EZ Media and Backup Center

  • 4.1.402.34662 to ≤ 4.1.402.34662affected

References