CVE-2018-9074 Iomega and LenovoEMC NAS Web UI Vulnerabilities

2018-09-2820:00:00

lenovo

www.cve.org

0.001 Low

EPSS

Percentile

27.1%

JSON

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file upload functionality of the Content Explorer application is vulnerable to path traversal. As a result, users can upload files anywhere on the device’s operating system as the root user.

CNA Affected

[
  {
    "product": "Iomega StorCenter",
    "vendor": "Lenovo Group LTD",
    "versions": [
      {
        "lessThanOrEqual": "4.1.402.34662",
        "status": "affected",
        "version": "4.1.402.34662",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "LenovoEMC",
    "vendor": "Lenovo Group LTD",
    "versions": [
      {
        "lessThanOrEqual": "4.1.402.34662",
        "status": "affected",
        "version": "4.1.402.34662",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "EZ Media and Backup Center",
    "vendor": "Lenovo Group LTD",
    "versions": [
      {
        "lessThanOrEqual": "4.1.402.34662",
        "status": "affected",
        "version": "4.1.402.34662",
        "versionType": "custom"
      }
    ]
  }
]

References

support.lenovo.com/us/en/solutions/LEN-24224

0.001 Low

EPSS

Percentile

27.1%

JSON

Related for CVELIST:CVE-2018-9074