CVE-2018-9082 - CVE House
Back to Database
Status published High CVE-2018-9082

Iomega and LenovoEMC NAS Web UI Vulnerabilities

Vulnerability Description

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the password changing functionality available to authenticated users does not require the user's current password to set a new one. As a result, attackers with access to the user's session tokens can change their password and retain access to the user's account

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-9082

Credits & Attribution

No credits recorded in the NVD database.

References

More from Lenovo Group LTD

View All →
CVE-2018-9081
Iomega and LenovoEMC NAS Web UI Vulnerabilities
Medium 4.7
CVE-2018-9080
Iomega and LenovoEMC NAS Web UI Vulnerabilities
Medium 5.9
CVE-2018-9079
Iomega and LenovoEMC NAS Web UI Vulnerabilities
Critical 9.8
CVE-2018-9078
Iomega and LenovoEMC NAS Web UI Vulnerabilities
High 8.8
CVE-2018-9077
Iomega and LenovoEMC NAS Web UI Vulnerabilities
High 8.1

Affected Vendor

Lenovo Group LTD

View all reports →

Affected Software

Iomega StorCenter, LenovoEMC, EZ Media and Backup Center
Vulnerable Versions:
4.1.402.34662

Timeline

Official Publish: September 28th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.