CVE-2018-9082

Iomega and LenovoEMC NAS Web UI Vulnerabilities

published September 28, 2018

CVSS
—
EPSS
1%
Percentile
53.1
In the wild
Unconfirmed
What it is

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the password changing functionality available to authenticated users does not require the user's current password to set a new one. As a result, attackers with access to the user's session tokens can change their password and retain access to the user's account

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00719 · 53.1th percentile
Published
2018-09-28T20:00Z
EPSS history
Timeline
  • 28 SEP 20:00Z
    Iomega and LenovoEMC NAS Web UI Vulnerabilities
    cvelistv5