What’s Vulnerable › Vulnerabilities

CVE-2018-9081: Iomega and LenovoEMC NAS Web UI Vulnerabilities

• Severity: medium (CVSS 4.7 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-09-28 · updated 2026-06-17
• Weakness: CWE-79

Description

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file name used for assets accessible through the Content Viewer application are vulnerable to self cross-site scripting self-XSS. As a result, adversaries can add files to shares accessible from the Content Viewer with a cross site scripting payload in its name, and wait for a user to try and rename the file for their payload to trigger.

Affected products

• Lenovo Ez Media & Backup Center Firmware: 4.1.402.34662
• Lenovo Ix2 Firmware: 4.1.402.34662
• Lenovo Ix4-300D Firmware: 4.1.402.34662
• Lenovo Px12-400R Firmware: 4.1.402.34662
• Lenovo Px12-450R Firmware: 4.1.402.34662
• Lenovo Px2-300D Firmware: 4.1.402.34662
• Lenovo Px4-300D Firmware: 4.1.402.34662
• Lenovo Px4-300R Firmware: 4.1.402.34662
• Lenovo Px4-400D Firmware: 4.1.402.34662
• Lenovo Px4-400R Firmware: 4.1.402.34662
• Lenovo Px6-300D Firmware: 4.1.402.34662
• Lenovo Storcenter Ix2-Dl Firmware: 4.1.402.34662
• Lenovo Storcenter Ix2 Firmware: 4.1.402.34662
• Lenovo Storcenter Ix4-300D Firmware: 4.1.402.34662
• Lenovo Storcenter Px12-400R Firmware: 4.1.402.34662
• Lenovo Storcenter Px12-450R Firmware: 4.1.402.34662
• Lenovo Storcenter Px2-300D Firmware: 4.1.402.34662
• Lenovo Storcenter Px4-300D Firmware: 4.1.402.34662
• Lenovo Storcenter Px4-300R Firmware: 4.1.402.34662
• Lenovo Storcenter Px6-300D Firmware: 4.1.402.34662

References

• https://support.lenovo.com/us/en/solutions/LEN-24224
• https://support.lenovo.com/us/en/solutions/LEN-24224

Get alerted when CVE-2018-9081 or the next vulnerability affects your stack