CVE-2019-6160

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-07-16 · updated 2026-06-17

Description

A vulnerability in various versions of Iomega and LenovoEMC NAS products could allow an unauthenticated user to access files on NAS shares via the API.

Affected products

Lenovo Home Media Network Hard Drive Firmware: before 3.2.16.30221 — fixed in 3.2.16.30221
Lenovo Ix12-300R Firmware: before 4.0.24.34808 — fixed in 4.0.24.34808
Lenovo Px12-350R Firmware: before 4.0.24.34808 — fixed in 4.0.24.34808
Lenovo Storcenter Ix2-200 Firmware: before 3.2.16.30221; before 2.1.50.30227 — fixed in 2.1.50.30227, 3.2.16.30221
Lenovo Storcenter Ix4-200D Firmware: before 3.2.16.30221; before 2.1.50.30227 — fixed in 2.1.50.30227, 3.2.16.30221
Lenovo Storcenter Ix4-200Rl Firmware: before 2.1.50.30227 — fixed in 2.1.50.30227

How to fix

Upgrade to a fixed version: Lenovo Home Media Network Hard Drive Firmware 3.2.16.30221; Lenovo Ix12-300R Firmware 4.0.24.34808; Lenovo Px12-350R Firmware 4.0.24.34808; Lenovo Storcenter Ix2-200 Firmware 2.1.50.30227, 3.2.16.30221; Lenovo Storcenter Ix4-200D Firmware 2.1.50.30227, 3.2.16.30221; Lenovo Storcenter Ix4-200Rl Firmware 2.1.50.30227. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-6160 or the next vulnerability affects your stack