Read the docs
TI-2018-06598 Aliases CVE-2018-9082GHSA-f5rx-9g37-6p6r

Iomega and LenovoEMC NAS Web UI Vulnerabilities

Priority LOW 39CWE-384Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-384.

Summary

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the password changing functionality available to authenticated users does not require the user's current password to set a new one. As a result, attackers with access to the user's session tokens can change their password and retain access to the user's account

Why it matters now

EPSS 0.00719 54th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LenovoIomega StorCenter4.1.402.34662 – 4.1.402.34662—No fix listedCNA
LenovoLenovoEMC4.1.402.34662 – 4.1.402.34662—No fix listedCNA
LenovoEZ Media and Backup Center4.1.402.34662 – 4.1.402.34662—No fix listedCNA
  • Iomega StorCenter VendorLenovo Affected 4.1.402.34662 – 4.1.402.34662 Fixed in — No fix listed CNA
  • LenovoEMC VendorLenovo Affected 4.1.402.34662 – 4.1.402.34662 Fixed in — No fix listed CNA
  • EZ Media and Backup Center VendorLenovo Affected 4.1.402.34662 – 4.1.402.34662 Fixed in — No fix listed CNA

CPE configurations NVD · 40

CPEVersionsRoleVendor
cpe:2.3:o:lenovo:storcenter_px12-450r_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:storcenter_px12-450r:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:storcenter_px12-400r_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:storcenter_px12-400r:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:storcenter_px4-300r_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:storcenter_px4-300r:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:storcenter_px6-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:storcenter_px6-300d:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:storcenter_px4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:storcenter_px4-300d:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
  • cpe:2.3:o:lenovo:storcenter_px12-450r_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:storcenter_px12-450r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:storcenter_px12-400r_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:storcenter_px12-400r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:storcenter_px4-300r_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:storcenter_px4-300r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:storcenter_px6-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:storcenter_px6-300d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:storcenter_px4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:storcenter_px4-300d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
Show 30 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:lenovo:storcenter_px2-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:storcenter_px2-300d:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:storcenter_ix4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:storcenter_ix4-300d:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:storcenter_ix2_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:storcenter_ix2:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:storcenter_ix2-dl_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:storcenter_ix2-dl:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:ez_media_\&_backup_center_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:ez_media_\&_backup_center:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:px12-450r_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:px12-450r:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:px12-400r_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:px12-400r:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:px4-400r_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:px4-400r:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:px4-300r_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:px4-300r:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:px6-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:px6-300d:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:px4-400d_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:px4-400d:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:px4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:px4-300d:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:px2-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:px2-300d:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:ix4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:ix4-300d:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:ix2_firmware:4.1.402.34662:*:*:*:*:*:*:*4.1.402.34662VulnerableLenovo
cpe:2.3:h:lenovo:ix2:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
  • cpe:2.3:o:lenovo:storcenter_px2-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:storcenter_px2-300d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:storcenter_ix4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:storcenter_ix4-300d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:storcenter_ix2_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:storcenter_ix2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:storcenter_ix2-dl_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:storcenter_ix2-dl:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:ez_media_\&_backup_center_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:ez_media_\&_backup_center:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:px12-450r_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:px12-450r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:px12-400r_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:px12-400r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:px4-400r_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:px4-400r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:px4-300r_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:px4-300r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:px6-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:px6-300d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:px4-400d_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:px4-400d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:px4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:px4-300d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:px2-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:px2-300d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:ix4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:ix4-300d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:ix2_firmware:4.1.402.34662:*:*:*:*:*:*:* Versions 4.1.402.34662 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:ix2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-9082
  2. 2026-10-03 Alias added: GHSA-f5rx-9g37-6p6r

References

Advisory 1

  • TI-2018-06595 Iomega and LenovoEMC NAS Web UI Vulnerabilities CVSS 3.0CRITICAL 9.8
  • TI-2018-06594 Iomega and LenovoEMC NAS Web UI Vulnerabilities CVSS 3.0HIGH 8.8
  • TI-2018-06596 Iomega and LenovoEMC NAS Web UI Vulnerabilities CVSS 3.0MEDIUM 5.9
  • TI-2018-06597 Iomega and LenovoEMC NAS Web UI Vulnerabilities CVSS 3.0MEDIUM 4.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences