Read the docs
TI-2018-06597 Aliases CVE-2018-9081GHSA-m3g4-7856-hf77

Iomega and LenovoEMC NAS Web UI Vulnerabilities

Priority LOW 22CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file name used for assets accessible through the Content Viewer application are vulnerable to self cross-site scripting self-XSS. As a result, adversaries can add files to shares accessible from the Content Viewer with a cross site scripting payload in its name, and wait for a user to try and rename the file for their payload to trigger.

Why it matters now

EPSS 0.0055 46th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LenovoIomega StorCenter4.1.402.34662 – 4.1.402.34662—No fix listedCNA
LenovoLenovoEMC4.1.402.34662 – 4.1.402.34662—No fix listedCNA
LenovoEZ Media and Backup Center4.1.402.34662 – 4.1.402.34662—No fix listedCNA
  • Iomega StorCenter VendorLenovo Affected 4.1.402.34662 – 4.1.402.34662 Fixed in — No fix listed CNA
  • LenovoEMC VendorLenovo Affected 4.1.402.34662 – 4.1.402.34662 Fixed in — No fix listed CNA
  • EZ Media and Backup Center VendorLenovo Affected 4.1.402.34662 – 4.1.402.34662 Fixed in — No fix listed CNA

CPE configurations NVD · 40

CPEVersionsRoleVendor
cpe:2.3:o:lenovo:storcenter_px12-450r_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:storcenter_px12-450r:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:storcenter_px12-400r_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:storcenter_px12-400r:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:storcenter_px4-300r_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:storcenter_px4-300r:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:storcenter_px6-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:storcenter_px6-300d:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:storcenter_px4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:storcenter_px4-300d:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
  • cpe:2.3:o:lenovo:storcenter_px12-450r_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:storcenter_px12-450r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:storcenter_px12-400r_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:storcenter_px12-400r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:storcenter_px4-300r_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:storcenter_px4-300r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:storcenter_px6-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:storcenter_px6-300d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:storcenter_px4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:storcenter_px4-300d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
Show 30 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:lenovo:storcenter_px2-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:storcenter_px2-300d:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:storcenter_ix4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:storcenter_ix4-300d:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:storcenter_ix2_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:storcenter_ix2:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:storcenter_ix2-dl_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:storcenter_ix2-dl:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:ez_media_\&_backup_center_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:ez_media_\&_backup_center:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:px12-450r_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:px12-450r:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:px12-400r_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:px12-400r:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:px4-400r_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:px4-400r:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:px4-300r_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:px4-300r:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:px6-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:px6-300d:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:px4-400d_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:px4-400d:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:px4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:px4-300d:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:px2-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:px2-300d:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:ix4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:ix4-300d:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:ix2_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:ix2:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
  • cpe:2.3:o:lenovo:storcenter_px2-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:storcenter_px2-300d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:storcenter_ix4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:storcenter_ix4-300d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:storcenter_ix2_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:storcenter_ix2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:storcenter_ix2-dl_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:storcenter_ix2-dl:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:ez_media_\&_backup_center_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:ez_media_\&_backup_center:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:px12-450r_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:px12-450r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:px12-400r_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:px12-400r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:px4-400r_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:px4-400r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:px4-300r_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:px4-300r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:px6-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:px6-300d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:px4-400d_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:px4-400d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:px4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:px4-300d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:px2-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:px2-300d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:ix4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:ix4-300d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:ix2_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:ix2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-9081
  2. 2026-10-03 Alias added: GHSA-m3g4-7856-hf77

References

Advisory 1

  • TI-2018-06595 Iomega and LenovoEMC NAS Web UI Vulnerabilities CVSS 3.0CRITICAL 9.8
  • TI-2018-06594 Iomega and LenovoEMC NAS Web UI Vulnerabilities CVSS 3.0HIGH 8.8
  • TI-2018-06598 Iomega and LenovoEMC NAS Web UI Vulnerabilities CVSS 3.0HIGH 8.8
  • TI-2018-06596 Iomega and LenovoEMC NAS Web UI Vulnerabilities CVSS 3.0MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences