What’s Vulnerable › Vulnerabilities

CVE-2018-9082: Iomega and LenovoEMC NAS Web UI Vulnerabilities

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-09-28 · updated 2026-06-17
• Weakness: CWE-384

Description

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the password changing functionality available to authenticated users does not require the user's current password to set a new one. As a result, attackers with access to the user's session tokens can change their password and retain access to the user's account

Affected products

• Lenovo Ez Media & Backup Center Firmware: 4.1.402.34662
• Lenovo Ix2 Firmware: 4.1.402.34662
• Lenovo Ix4-300D Firmware: 4.1.402.34662
• Lenovo Px12-400R Firmware: 4.1.402.34662
• Lenovo Px12-450R Firmware: 4.1.402.34662
• Lenovo Px2-300D Firmware: 4.1.402.34662
• Lenovo Px4-300D Firmware: 4.1.402.34662
• Lenovo Px4-300R Firmware: 4.1.402.34662
• Lenovo Px4-400D Firmware: 4.1.402.34662
• Lenovo Px4-400R Firmware: 4.1.402.34662
• Lenovo Px6-300D Firmware: 4.1.402.34662
• Lenovo Storcenter Ix2-Dl Firmware: 4.1.402.34662
• Lenovo Storcenter Ix2 Firmware: 4.1.402.34662
• Lenovo Storcenter Ix4-300D Firmware: 4.1.402.34662
• Lenovo Storcenter Px12-400R Firmware: 4.1.402.34662
• Lenovo Storcenter Px12-450R Firmware: 4.1.402.34662
• Lenovo Storcenter Px2-300D Firmware: 4.1.402.34662
• Lenovo Storcenter Px4-300D Firmware: 4.1.402.34662
• Lenovo Storcenter Px4-300R Firmware: 4.1.402.34662
• Lenovo Storcenter Px6-300D Firmware: 4.1.402.34662

References

• https://support.lenovo.com/us/en/solutions/LEN-24224
• https://support.lenovo.com/us/en/solutions/LEN-24224

Get alerted when CVE-2018-9082 or the next vulnerability affects your stack