CVE-2018-9080 - CVE House
Back to Database
Status published Medium CVE-2018-9080

Iomega and LenovoEMC NAS Web UI Vulnerabilities

Vulnerability Description

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, by setting the Iomega cookie to a known value before logging into the NAS's web application, the NAS will not provide the user a new cookie value. This allows an attacker who knows the cookie's value to compromise the user's session.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-9080

Credits & Attribution

No credits recorded in the NVD database.

References

More from Lenovo Group LTD

View All →
CVE-2018-9082
Iomega and LenovoEMC NAS Web UI Vulnerabilities
High 8.8
CVE-2018-9081
Iomega and LenovoEMC NAS Web UI Vulnerabilities
Medium 4.7
CVE-2018-9079
Iomega and LenovoEMC NAS Web UI Vulnerabilities
Critical 9.8
CVE-2018-9078
Iomega and LenovoEMC NAS Web UI Vulnerabilities
High 8.8
CVE-2018-9077
Iomega and LenovoEMC NAS Web UI Vulnerabilities
High 8.1

Affected Vendor

Lenovo Group LTD

View all reports →

Affected Software

Iomega StorCenter, LenovoEMC, EZ Media and Backup Center
Vulnerable Versions:
4.1.402.34662

Timeline

Official Publish: September 28th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.