CVE-2019-6160: High severity lenovo px12-350r firmware vulnerability
Published Jul 16, 2019
·Updated
A vulnerability in various versions of Iomega and LenovoEMC NAS products could allow an unauthenticated user to access files on NAS shares via the API.
Affected Software
15 affected components
Lenovo Px12-350r Firmware<4.0.24.34808
Lenovo Px12-350r
Lenovo Ix12-300r Firmware<4.0.24.34808
Lenovo Ix12-300r
Lenovo Home Media Network Hard Drive Firmware<3.2.16.30221
Lenovo Home Media Network Hard Drive
Lenovo Storcenter Ix2-200 Firmware<3.2.16.30221
Lenovo Storcenter Ix2-200
Lenovo Storcenter Ix4-200d Firmware<3.2.16.30221
Lenovo Storcenter Ix4-200d
Lenovo Storcenter Ix2-200 Firmware<2.1.50.30227
Lenovo Storcenter Ix-200
Lenovo Storcenter Ix4-200d Firmware<2.1.50.30227
Lenovo Storcenter Ix4-200rl Firmware<2.1.50.30227
Lenovo Storcenter Ix4-200rl
Remediation
Patch Available
Information
Update to the firmware level (or later) described for your system in the Product Impact section of LEN-25557. If it is not feasible to update the firmware immediately, partial protection can be achieved by removing any public shares and using the device only on trusted networks.
Event History
Jul 16, 2019
CVE Published
via MITRE·06:53 PM
Data Sourced
via MITRE·06:53 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2019-6160?
CVE-2019-6160 has a high severity rating, allowing unauthorized access to files on NAS shares.
2
How do I fix CVE-2019-6160?
To mitigate CVE-2019-6160, update your Iomega or LenovoEMC NAS products to the latest firmware version.
3
Which products are affected by CVE-2019-6160?
CVE-2019-6160 affects multiple versions of Iomega and LenovoEMC NAS products, including Lenovo PX12-350r and IX12-300r.
4
Can an unauthenticated user exploit CVE-2019-6160?
Yes, an unauthenticated user can exploit CVE-2019-6160 to access protected files via the API.
5
What kind of access does CVE-2019-6160 allow?
CVE-2019-6160 allows access to files on NAS shares without authentication, posing a significant security risk.