CVE-2018-9079: Iomega and LenovoEMC NAS Web UI Vulnerabilities

Published Sep 28, 2018

Updated

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, adversaries can craft URLs to modify the Document Object Model (DOM) of the page. In addition, adversaries can inject HTML script tags and HTML tags with JavaScript handlers to execute arbitrary JavaScript with the origin of the device.

Affected Software

40 affected components

Lenovo Storcenter Px12-450r Firmware=4.1.402.34662

Lenovo Storcenter Px12-450r

Lenovo Storcenter Px12-400r Firmware=4.1.402.34662

Lenovo Storcenter Px12-400r

Lenovo Storcenter Px4-300r Firmware=4.1.402.34662

Lenovo Storcenter Px4-300r

Lenovo Storcenter Px6-300d Firmware=4.1.402.34662

Lenovo Storcenter Px6-300d

Lenovo Storcenter Px4-300d Firmware=4.1.402.34662

Lenovo Storcenter Px4-300d

Lenovo Storcenter Px2-300d Firmware=4.1.402.34662

Lenovo Storcenter Px2-300d

Lenovo Storcenter Ix4-300d Firmware=4.1.402.34662

Lenovo Storcenter Ix4-300d

Lenovo Storcenter Ix2 Firmware=4.1.402.34662

Lenovo Storcenter Ix2

Lenovo Storcenter Ix2-dl Firmware=4.1.402.34662

Lenovo Storcenter Ix2-dl

Lenovo Ez Media \& Backup Center Firmware=4.1.402.34662

Lenovo Ez Media \& Backup Center

Lenovo Px12-450r Firmware=4.1.402.34662

Lenovo Px12-450r

Lenovo Px12-400r Firmware=4.1.402.34662

Lenovo Px12-400r

Lenovo Px4-400r Firmware=4.1.402.34662

Lenovo Px4-400r

Lenovo Px4-300r Firmware=4.1.402.34662

Lenovo Px4-300r

Lenovo Px6-300d Firmware=4.1.402.34662

Lenovo Px6-300d

Lenovo Px4-400d Firmware=4.1.402.34662

Lenovo Px4-400d

Lenovo Px4-300d Firmware=4.1.402.34662

Lenovo Px4-300d

Lenovo Px2-300d Firmware=4.1.402.34662

Lenovo Px2-300d

Lenovo Ix4-300d Firmware=4.1.402.34662

Lenovo Ix4-300d

Lenovo Ix2 Firmware=4.1.402.34662

Lenovo Ix2

Event History

Sep 28, 2018

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-9079?

CVE-2018-9079 has a medium severity rating due to its potential impact on the Document Object Model (DOM) and the ability to execute arbitrary JavaScript in affected devices.

How do I fix CVE-2018-9079?

To fix CVE-2018-9079, update the device firmware to a version later than 4.1.402.34662.

Which devices are affected by CVE-2018-9079?

CVE-2018-9079 affects several Iomega, Lenovo, and LenovoEMC NAS devices running firmware version 4.1.402.34662 or earlier.

Can CVE-2018-9079 allow remote execution of scripts?

Yes, CVE-2018-9079 can allow adversaries to inject HTML script tags and execute arbitrary JavaScript remotely.

What are the consequences of not addressing CVE-2018-9079?

Failing to address CVE-2018-9079 could lead to unauthorized access, data manipulation, or further exploitation of the vulnerable NAS devices.