CVE-2018-9079 Iomega and LenovoEMC NAS Web UI Vulnerabilities
CriticalCVSS 9.8
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, adversaries can craft URLs to modify the Document Object Model (DOM) of the page. In addition, adversaries can inject HTML script tags and HTML tags with JavaScript handlers to execute arbitrary JavaScript with the origin of the device.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Lenovo storcenter px12-450r firmware | = 4.1.402.34662 | No fix listed |
| Lenovo storcenter px12-400r firmware | = 4.1.402.34662 | No fix listed |
| Lenovo storcenter px4-300r firmware | = 4.1.402.34662 | No fix listed |
| Lenovo storcenter px6-300d firmware | = 4.1.402.34662 | No fix listed |
| Lenovo storcenter px4-300d firmware | = 4.1.402.34662 | No fix listed |
| Lenovo storcenter px2-300d firmware | = 4.1.402.34662 | No fix listed |
| Lenovo storcenter ix4-300d firmware | = 4.1.402.34662 | No fix listed |
| Lenovo storcenter ix2 firmware | = 4.1.402.34662 | No fix listed |
| Lenovo storcenter ix2-dl firmware | = 4.1.402.34662 | No fix listed |
| Lenovo ez media backup center firmware | = 4.1.402.34662 | No fix listed |
| Lenovo px12-450r firmware | = 4.1.402.34662 | No fix listed |
| Lenovo px12-400r firmware | = 4.1.402.34662 | No fix listed |
| Lenovo px4-400r firmware | = 4.1.402.34662 | No fix listed |
| Lenovo px4-300r firmware | = 4.1.402.34662 | No fix listed |
| Lenovo px6-300d firmware | = 4.1.402.34662 | No fix listed |
| Lenovo px4-400d firmware | = 4.1.402.34662 | No fix listed |
| Lenovo px4-300d firmware | = 4.1.402.34662 | No fix listed |
| Lenovo px2-300d firmware | = 4.1.402.34662 | No fix listed |
| Lenovo ix4-300d firmware | = 4.1.402.34662 | No fix listed |
| Lenovo ix2 firmware | = 4.1.402.34662 | No fix listed |
| Lenovo Group Ltd. Iomega StorCenter | >= 4.1.402.34662, <= 4.1.402.34662 | No fix listed |
| Lenovo Group Ltd. LenovoEMC | >= 4.1.402.34662, <= 4.1.402.34662 | No fix listed |
| Lenovo Group Ltd. EZ Media and Backup Center | >= 4.1.402.34662, <= 4.1.402.34662 | No fix listed |
References
- support.lenovo.com vendor-advisory