CVE-2018-9080: Iomega and LenovoEMC NAS Web UI Vulnerabilities
First published: Fri Sep 28 2018(Updated: )
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, by setting the Iomega cookie to a known value before logging into the NAS's web application, the NAS will not provide the user a new cookie value. This allows an attacker who knows the cookie's value to compromise the user's session.
Credit: psirt@lenovo.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Lenovo Storcenter PX12-450R | =4.1.402.34662 | |
| Lenovo StorCenter PX12-450R Firmware | ||
| Lenovo PX12-400R | =4.1.402.34662 | |
| Lenovo Storage Center PX12-400R | ||
| Lenovo StorCenter PX4-300R | =4.1.402.34662 | |
| Lenovo Storcenter PX4-300R Firmware | ||
| Lenovo PX6-300D Firmware | =4.1.402.34662 | |
| Lenovo Iomega StorCenter PX6-300D | ||
| Lenovo Storcenter PX4-300D Firmware | =4.1.402.34662 | |
| Lenovo Iomega StorCenter PX4-300D | ||
| Lenovo Storcenter PX2-300D Firmware | =4.1.402.34662 | |
| Lenovo Iomega StorCenter PX2-300D | ||
| Lenovo Storcenter IX4-300D Firmware | =4.1.402.34662 | |
| Lenovo Storcenter IX4-300D Firmware | ||
| Lenovo Storage IX2 Firmware | =4.1.402.34662 | |
| Lenovo Iomega StorCenter ix2-dl | ||
| Lenovo StorCenter ix2-dl | =4.1.402.34662 | |
| Lenovo StorCenter ix2-dl Firmware | ||
| Lenovo EZ Media & Backup Center Firmware | =4.1.402.34662 | |
| Lenovo Ez Media & Backup Center | ||
| Lenovo Storcenter PX12-450R | =4.1.402.34662 | |
| Lenovo EMC px12-400r/450r | ||
| Lenovo Storcenter PX12-400R Firmware | =4.1.402.34662 | |
| Lenovo Storage Center PX12-400R | ||
| Lenovo px4-400r | =4.1.402.34662 | |
| Lenovo EMC px4-400r | ||
| Lenovo Storcenter PX4-300R Firmware | =4.1.402.34662 | |
| Lenovo StorCenter PX4-300R | ||
| Lenovo StorCenter PX6-300D Firmware | =4.1.402.34662 | |
| Lenovo EMC PX6-300D | ||
| Lenovo PX4-400D | =4.1.402.34662 | |
| Lenovo PX4-400D | ||
| Lenovo Storcenter PX4-300D Firmware | =4.1.402.34662 | |
| Lenovo EMC px4-300d | ||
| Lenovo Storcenter PX2-300D Firmware | =4.1.402.34662 | |
| Lenovo EMC px2-300d | ||
| Lenovo Storcenter IX4-300D Firmware | =4.1.402.34662 | |
| Lenovo EMC ix4-300d | ||
| Lenovo Storage IX2 Firmware | =4.1.402.34662 | |
| Lenovo ix2 firmware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2018-9080?
CVE-2018-9080 is considered a medium-risk vulnerability due to its potential for session fixation attacks.
How do I fix CVE-2018-9080?
To fix CVE-2018-9080, update the firmware of your Lenovo and Iomega NAS devices to versions later than 4.1.402.34662.
Which devices are affected by CVE-2018-9080?
CVE-2018-9080 affects Lenovo Storcenter Px12-450r, Px12-400r, Px4-300r, Px6-300d, Px2-300d, and similar NAS devices with firmware version 4.1.402.34662.
What type of attack does CVE-2018-9080 facilitate?
CVE-2018-9080 enables session fixation attacks by allowing an attacker to set a known cookie value before user login.
Is CVE-2018-9080 easily exploitable?
Yes, CVE-2018-9080 is easily exploitable if an attacker can access the NAS web application, making it critical to implement protective measures.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/title
- agent/severity
- agent/author
- agent/references
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/lenovo
- canonical/lenovo storcenter px12-450r
- version/lenovo storcenter px12-450r/4.1.402.34662
- canonical/lenovo storcenter px12-450r firmware
- canonical/lenovo px12-400r
- version/lenovo px12-400r/4.1.402.34662
- canonical/lenovo storage center px12-400r
- canonical/lenovo storcenter px4-300r
- version/lenovo storcenter px4-300r/4.1.402.34662
- canonical/lenovo storcenter px4-300r firmware
- canonical/lenovo px6-300d firmware
- version/lenovo px6-300d firmware/4.1.402.34662
- canonical/lenovo iomega storcenter px6-300d
- canonical/lenovo storcenter px4-300d firmware
- version/lenovo storcenter px4-300d firmware/4.1.402.34662
- canonical/lenovo iomega storcenter px4-300d
- canonical/lenovo storcenter px2-300d firmware
- version/lenovo storcenter px2-300d firmware/4.1.402.34662
- canonical/lenovo iomega storcenter px2-300d
- canonical/lenovo storcenter ix4-300d firmware
- version/lenovo storcenter ix4-300d firmware/4.1.402.34662
- canonical/lenovo storage ix2 firmware
- version/lenovo storage ix2 firmware/4.1.402.34662
- canonical/lenovo iomega storcenter ix2-dl
- canonical/lenovo storcenter ix2-dl
- version/lenovo storcenter ix2-dl/4.1.402.34662
- canonical/lenovo storcenter ix2-dl firmware
- canonical/lenovo ez media & backup center firmware
- version/lenovo ez media & backup center firmware/4.1.402.34662
- canonical/lenovo ez media & backup center
- canonical/lenovo emc px12-400r/450r
- canonical/lenovo storcenter px12-400r firmware
- version/lenovo storcenter px12-400r firmware/4.1.402.34662
- canonical/lenovo px4-400r
- version/lenovo px4-400r/4.1.402.34662
- canonical/lenovo emc px4-400r
- version/lenovo storcenter px4-300r firmware/4.1.402.34662
- canonical/lenovo storcenter px6-300d firmware
- version/lenovo storcenter px6-300d firmware/4.1.402.34662
- canonical/lenovo emc px6-300d
- canonical/lenovo px4-400d
- version/lenovo px4-400d/4.1.402.34662
- canonical/lenovo emc px4-300d
- canonical/lenovo emc px2-300d
- canonical/lenovo emc ix4-300d
- canonical/lenovo ix2 firmware