What’s Vulnerable › Vulnerabilities

CVE-2018-9080: Iomega and LenovoEMC NAS Web UI Vulnerabilities

• Severity: medium (CVSS 5.9 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-09-28 · updated 2026-06-17
• Weakness: CWE-287

Description

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, by setting the Iomega cookie to a known value before logging into the NAS's web application, the NAS will not provide the user a new cookie value. This allows an attacker who knows the cookie's value to compromise the user's session.

Affected products

• Lenovo Ez Media & Backup Center Firmware: 4.1.402.34662
• Lenovo Ix2 Firmware: 4.1.402.34662
• Lenovo Ix4-300D Firmware: 4.1.402.34662
• Lenovo Px12-400R Firmware: 4.1.402.34662
• Lenovo Px12-450R Firmware: 4.1.402.34662
• Lenovo Px2-300D Firmware: 4.1.402.34662
• Lenovo Px4-300D Firmware: 4.1.402.34662
• Lenovo Px4-300R Firmware: 4.1.402.34662
• Lenovo Px4-400D Firmware: 4.1.402.34662
• Lenovo Px4-400R Firmware: 4.1.402.34662
• Lenovo Px6-300D Firmware: 4.1.402.34662
• Lenovo Storcenter Ix2-Dl Firmware: 4.1.402.34662
• Lenovo Storcenter Ix2 Firmware: 4.1.402.34662
• Lenovo Storcenter Ix4-300D Firmware: 4.1.402.34662
• Lenovo Storcenter Px12-400R Firmware: 4.1.402.34662
• Lenovo Storcenter Px12-450R Firmware: 4.1.402.34662
• Lenovo Storcenter Px2-300D Firmware: 4.1.402.34662
• Lenovo Storcenter Px4-300D Firmware: 4.1.402.34662
• Lenovo Storcenter Px4-300R Firmware: 4.1.402.34662
• Lenovo Storcenter Px6-300D Firmware: 4.1.402.34662

References

• https://support.lenovo.com/us/en/solutions/LEN-24224
• https://support.lenovo.com/us/en/solutions/LEN-24224

Get alerted when CVE-2018-9080 or the next vulnerability affects your stack