CVE-2018-9081: Iomega and LenovoEMC NAS Web UI Vulnerabilities
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file name used for assets accessible through the Content Viewer application are vulnerable to self cross-site scripting self-XSS. As a result, adversaries can add files to shares accessible from the Content Viewer with a cross site scripting payload in its name, and wait for a user to try and rename the file for their payload to trigger.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-9081?
CVE-2018-9081 has been classified as a medium severity vulnerability due to its potential for self-XSS exploitation in affected Iomega and Lenovo NAS devices.
How do I fix CVE-2018-9081?
To fix CVE-2018-9081, update the device firmware to a version later than 4.1.402.34662 that addresses the self-XSS vulnerability.
Which devices are affected by CVE-2018-9081?
CVE-2018-9081 affects several Lenovo NAS devices running firmware version 4.1.402.34662 or earlier, including the Storcenter Px12, Px4, Px6, and Ix series.
What type of vulnerability is CVE-2018-9081?
CVE-2018-9081 is a self-cross-site scripting (self-XSS) vulnerability that allows an attacker to execute scripts in the context of a user's session.
Can CVE-2018-9081 be exploited remotely?
CVE-2018-9081 is primarily an internal threat as it involves self-XSS, which requires user interaction to exploit.