CVE-2018-9082 | ByteOS Network

Vulnerability Details :

CVE-2018-9082

Assigner-lenovo

Assigner Org ID-da227ddf-6e25-4b41-b023-0f976dcaca4b

Published At-28 Sep, 2018 | 20:00

Updated At-05 Aug, 2024 | 07:17

Iomega and LenovoEMC NAS Web UI Vulnerabilities

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the password changing functionality available to authenticated users does not require the user's current password to set a new one. As a result, attackers with access to the user's session tokens can change their password and retain access to the user's account

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:lenovo

Assigner Org ID:da227ddf-6e25-4b41-b023-0f976dcaca4b

Published At:28 Sep, 2018 | 20:00

Updated At:05 Aug, 2024 | 07:17

▼CVE Numbering Authority (CNA)

Iomega and LenovoEMC NAS Web UI Vulnerabilities

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the password changing functionality available to authenticated users does not require the user's current password to set a new one. As a result, attackers with access to the user's session tokens can change their password and retain access to the user's account

Affected Products

Vendor

Lenovo Group Limited

Product

Iomega StorCenter

Versions

Affected

From 4.1.402.34662 through 4.1.402.34662 (custom)

Vendor

Lenovo Group Limited

Product

Versions

Affected

From 4.1.402.34662 through 4.1.402.34662 (custom)

Vendor

Lenovo Group Limited

Product

EZ Media and Backup Center

Versions

Affected

From 4.1.402.34662 through 4.1.402.34662 (custom)

Problem Types

Type	CWE ID	Description
text	N/A	Password change does not require existing password

Type: text

CWE ID: N/A

Description: Password change does not require existing password

References

Hyperlink	Resource
https://support.lenovo.com/us/en/solutions/LEN-24224	x_refsource_CONFIRM

Hyperlink: https://support.lenovo.com/us/en/solutions/LEN-24224

Resource:

x_refsource_CONFIRM

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://support.lenovo.com/us/en/solutions/LEN-24224	x_refsource_CONFIRM x_transferred

Hyperlink: https://support.lenovo.com/us/en/solutions/LEN-24224

Resource:

x_refsource_CONFIRM

x_transferred

▼National Vulnerability Database (NVD)

Source:psirt@lenovo.com

Published At:28 Sep, 2018 | 20:29

Updated At:07 Jan, 2019 | 19:38

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the password changing functionality available to authenticated users does not require the user's current password to set a new one. As a result, attackers with access to the user's session tokens can change their password and retain access to the user's account

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	8.8	HIGH	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	4.0	MEDIUM	AV:N/AC:L/Au:S/C:N/I:P/A:N

Type: Primary

Version: 3.0

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 4.0

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:S/C:N/I:P/A:N

CPE Matches

Lenovo Group Limited

>>storcenter_px12-450r_firmware>>4.1.402.34662

cpe:2.3:o:lenovo:storcenter_px12-450r_firmware:4.1.402.34662:*:*:*:*:*:*:*

Lenovo Group Limited

>>storcenter_px12-450r>>-

cpe:2.3:h:lenovo:storcenter_px12-450r:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>storcenter_px12-400r_firmware>>4.1.402.34662

cpe:2.3:o:lenovo:storcenter_px12-400r_firmware:4.1.402.34662:*:*:*:*:*:*:*

Lenovo Group Limited

>>storcenter_px12-400r>>-

cpe:2.3:h:lenovo:storcenter_px12-400r:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>storcenter_px4-300r_firmware>>4.1.402.34662

cpe:2.3:o:lenovo:storcenter_px4-300r_firmware:4.1.402.34662:*:*:*:*:*:*:*

Lenovo Group Limited

>>storcenter_px4-300r>>-

cpe:2.3:h:lenovo:storcenter_px4-300r:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>storcenter_px6-300d_firmware>>4.1.402.34662

cpe:2.3:o:lenovo:storcenter_px6-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*

Lenovo Group Limited

>>storcenter_px6-300d>>-

cpe:2.3:h:lenovo:storcenter_px6-300d:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>storcenter_px4-300d_firmware>>4.1.402.34662

cpe:2.3:o:lenovo:storcenter_px4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*

Lenovo Group Limited

>>storcenter_px4-300d>>-

cpe:2.3:h:lenovo:storcenter_px4-300d:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>storcenter_px2-300d_firmware>>4.1.402.34662

cpe:2.3:o:lenovo:storcenter_px2-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*

Lenovo Group Limited

>>storcenter_px2-300d>>-

cpe:2.3:h:lenovo:storcenter_px2-300d:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>storcenter_ix4-300d_firmware>>4.1.402.34662

cpe:2.3:o:lenovo:storcenter_ix4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*

Lenovo Group Limited

>>storcenter_ix4-300d>>-

cpe:2.3:h:lenovo:storcenter_ix4-300d:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>storcenter_ix2_firmware>>4.1.402.34662

cpe:2.3:o:lenovo:storcenter_ix2_firmware:4.1.402.34662:*:*:*:*:*:*:*

Lenovo Group Limited

>>storcenter_ix2>>-

cpe:2.3:h:lenovo:storcenter_ix2:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>storcenter_ix2-dl_firmware>>4.1.402.34662

cpe:2.3:o:lenovo:storcenter_ix2-dl_firmware:4.1.402.34662:*:*:*:*:*:*:*

Lenovo Group Limited

>>storcenter_ix2-dl>>-

cpe:2.3:h:lenovo:storcenter_ix2-dl:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ez_media_\&_backup_center_firmware>>4.1.402.34662

cpe:2.3:o:lenovo:ez_media_\&_backup_center_firmware:4.1.402.34662:*:*:*:*:*:*:*

Lenovo Group Limited

>>ez_media_\&_backup_center>>-

cpe:2.3:h:lenovo:ez_media_\&_backup_center:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>px12-450r_firmware>>4.1.402.34662

cpe:2.3:o:lenovo:px12-450r_firmware:4.1.402.34662:*:*:*:*:*:*:*

Lenovo Group Limited

cpe:2.3:h:lenovo:px12-450r:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>px12-400r_firmware>>4.1.402.34662

cpe:2.3:o:lenovo:px12-400r_firmware:4.1.402.34662:*:*:*:*:*:*:*

Lenovo Group Limited

cpe:2.3:h:lenovo:px12-400r:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>px4-400r_firmware>>4.1.402.34662

cpe:2.3:o:lenovo:px4-400r_firmware:4.1.402.34662:*:*:*:*:*:*:*

Lenovo Group Limited

cpe:2.3:h:lenovo:px4-400r:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>px4-300r_firmware>>4.1.402.34662

cpe:2.3:o:lenovo:px4-300r_firmware:4.1.402.34662:*:*:*:*:*:*:*

Lenovo Group Limited

cpe:2.3:h:lenovo:px4-300r:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>px6-300d_firmware>>4.1.402.34662

cpe:2.3:o:lenovo:px6-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*

Lenovo Group Limited

cpe:2.3:h:lenovo:px6-300d:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>px4-400d_firmware>>4.1.402.34662

cpe:2.3:o:lenovo:px4-400d_firmware:4.1.402.34662:*:*:*:*:*:*:*

Lenovo Group Limited

cpe:2.3:h:lenovo:px4-400d:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>px4-300d_firmware>>4.1.402.34662

cpe:2.3:o:lenovo:px4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*

Lenovo Group Limited

cpe:2.3:h:lenovo:px4-300d:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>px2-300d_firmware>>4.1.402.34662

cpe:2.3:o:lenovo:px2-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*

Lenovo Group Limited

cpe:2.3:h:lenovo:px2-300d:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ix4-300d_firmware>>4.1.402.34662

cpe:2.3:o:lenovo:ix4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*

Lenovo Group Limited

cpe:2.3:h:lenovo:ix4-300d:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ix2_firmware>>4.1.402.34662

cpe:2.3:o:lenovo:ix2_firmware:4.1.402.34662:*:*:*:*:*:*:*

Lenovo Group Limited

>>ix2>>-

cpe:2.3:h:lenovo:ix2:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ez_media_\&_backup_center_firmware>>4.1.402.34662

cpe:2.3:o:lenovo:ez_media_\&_backup_center_firmware:4.1.402.34662:*:*:*:*:*:*:*

Lenovo Group Limited

>>ez_media_\&_backup_center>>-

cpe:2.3:h:lenovo:ez_media_\&_backup_center:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-384	Primary	nvd@nist.gov

CWE ID: CWE-384

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://support.lenovo.com/us/en/solutions/LEN-24224	psirt@lenovo.com	Vendor Advisory

Hyperlink: https://support.lenovo.com/us/en/solutions/LEN-24224

Source: psirt@lenovo.com

Resource:

Vendor Advisory