Read the docs
TI-2018-06596 Aliases CVE-2018-9080GHSA-6ff8-jv2v-3qhh

Iomega and LenovoEMC NAS Web UI Vulnerabilities

Priority LOW 28CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, by setting the Iomega cookie to a known value before logging into the NAS's web application, the NAS will not provide the user a new cookie value. This allows an attacker who knows the cookie's value to compromise the user's session.

Why it matters now

EPSS 0.00727 54th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LenovoIomega StorCenter4.1.402.34662 – 4.1.402.34662—No fix listedCNA
LenovoLenovoEMC4.1.402.34662 – 4.1.402.34662—No fix listedCNA
LenovoEZ Media and Backup Center4.1.402.34662 – 4.1.402.34662—No fix listedCNA
  • Iomega StorCenter VendorLenovo Affected 4.1.402.34662 – 4.1.402.34662 Fixed in — No fix listed CNA
  • LenovoEMC VendorLenovo Affected 4.1.402.34662 – 4.1.402.34662 Fixed in — No fix listed CNA
  • EZ Media and Backup Center VendorLenovo Affected 4.1.402.34662 – 4.1.402.34662 Fixed in — No fix listed CNA

CPE configurations NVD · 40

CPEVersionsRoleVendor
cpe:2.3:o:lenovo:storcenter_px12-450r_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:storcenter_px12-450r:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:storcenter_px12-400r_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:storcenter_px12-400r:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:storcenter_px4-300r_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:storcenter_px4-300r:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:storcenter_px6-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:storcenter_px6-300d:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:storcenter_px4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:storcenter_px4-300d:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
  • cpe:2.3:o:lenovo:storcenter_px12-450r_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:storcenter_px12-450r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:storcenter_px12-400r_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:storcenter_px12-400r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:storcenter_px4-300r_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:storcenter_px4-300r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:storcenter_px6-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:storcenter_px6-300d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:storcenter_px4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:storcenter_px4-300d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
Show 30 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:lenovo:storcenter_px2-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:storcenter_px2-300d:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:storcenter_ix4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:storcenter_ix4-300d:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:storcenter_ix2_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:storcenter_ix2:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:storcenter_ix2-dl_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:storcenter_ix2-dl:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:ez_media_\&_backup_center_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:ez_media_\&_backup_center:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:px12-450r_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:px12-450r:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:px12-400r_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:px12-400r:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:px4-400r_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:px4-400r:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:px4-300r_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:px4-300r:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:px6-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:px6-300d:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:px4-400d_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:px4-400d:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:px4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:px4-300d:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:px2-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:px2-300d:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:ix4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:ix4-300d:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:ix2_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:ix2:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
  • cpe:2.3:o:lenovo:storcenter_px2-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:storcenter_px2-300d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:storcenter_ix4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:storcenter_ix4-300d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:storcenter_ix2_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:storcenter_ix2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:storcenter_ix2-dl_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:storcenter_ix2-dl:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:ez_media_\&_backup_center_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:ez_media_\&_backup_center:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:px12-450r_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:px12-450r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:px12-400r_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:px12-400r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:px4-400r_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:px4-400r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:px4-300r_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:px4-300r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:px6-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:px6-300d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:px4-400d_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:px4-400d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:px4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:px4-300d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:px2-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:px2-300d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:ix4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:ix4-300d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:ix2_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:ix2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-9080
  2. 2026-10-03 Alias added: GHSA-6ff8-jv2v-3qhh

References

Advisory 1

  • TI-2018-06595 Iomega and LenovoEMC NAS Web UI Vulnerabilities CVSS 3.0CRITICAL 9.8
  • TI-2018-06594 Iomega and LenovoEMC NAS Web UI Vulnerabilities CVSS 3.0HIGH 8.8
  • TI-2018-06598 Iomega and LenovoEMC NAS Web UI Vulnerabilities CVSS 3.0HIGH 8.8
  • TI-2018-06597 Iomega and LenovoEMC NAS Web UI Vulnerabilities CVSS 3.0MEDIUM 4.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences