CVE-2018-9080
Status: ModifiedMedium (5.9)—
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, by setting the Iomega cookie to a known value before logging into the NAS's web application, the NAS will not provide the user a new cookie value. This allows an attacker who knows the cookie's value to compromise the user's session.
CVSS
- Version: 3.0
- Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- Base score: 5.9
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 0.73%
- Percentile among all scored CVEs: 53
- Score date: 10/4/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (20)
Lenovo — EZ Media & Backup Center FirmwareLenovo — IX2 FirmwareLenovo — Ix4-300d FirmwareLenovo — Px12-400r FirmwareLenovo — Px12-450r FirmwareLenovo — Px2-300d FirmwareLenovo — Px4-300d FirmwareLenovo — Px4-300r FirmwareLenovo — Px4-400d FirmwareLenovo — Px4-400r FirmwareLenovo — Px6-300d FirmwareLenovo — Storcenter Ix2-dl FirmwareLenovo — Storcenter IX2 FirmwareLenovo — Storcenter Ix4-300d FirmwareLenovo — Storcenter Px12-400r FirmwareLenovo — Storcenter Px12-450r FirmwareLenovo — Storcenter Px2-300d FirmwareLenovo — Storcenter Px4-300d FirmwareLenovo — Storcenter Px4-300r FirmwareLenovo — Storcenter Px6-300d Firmware
CWEs
- CWE-287
References
Raw JSON (NVD)
Show
{
"id": "CVE-2018-9080",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 5.9,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "HIGH",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 2.2
}
]
},
"affected": [
{
"source": "psirt@lenovo.com",
"affectedData": [
{
"vendor": "Lenovo Group LTD",
"product": "Iomega StorCenter",
"versions": [
{
"status": "affected",
"version": "4.1.402.34662",
"versionType": "custom",
"lessThanOrEqual": "4.1.402.34662"
}
]
},
{
"vendor": "Lenovo Group LTD",
"product": "LenovoEMC",
"versions": [
{
"status": "affected",
"version": "4.1.402.34662",
"versionType": "custom",
"lessThanOrEqual": "4.1.402.34662"
}
]
},
{
"vendor": "Lenovo Group LTD",
"product": "EZ Media and Backup Center",
"versions": [
{
"status": "affected",
"version": "4.1.402.34662",
"versionType": "custom",
"lessThanOrEqual": "4.1.402.34662"
}
]
}
]
}
],
"published": "2018-09-28T20:29:01.313",
"references": [
{
"url": "https://support.lenovo.com/us/en/solutions/LEN-24224",
"tags": [
"Vendor Advisory"
],
"source": "psirt@lenovo.com"
},
{
"url": "https://support.lenovo.com/us/en/solutions/LEN-24224",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-287"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, by setting the Iomega cookie to a known value before logging into the NAS's web application, the NAS will not provide the user a new cookie value. This allows an attacker who knows the cookie's value to compromise the user's session."
},
{
"lang": "es",
"value": "Para algunos dispositivos NAS Iomega, Lenovo y LenovoEMC en versiones 4.1.402.34662 y anteriores, al establecer la cookie Iomega a un valor conocido antes de iniciar sesión en la aplicación web de NAS, ésta no proporcionará al usuario un nuevo valor de cookie. Esto permite que un atacante que conozca el valor de la cookie comprometa la sesión del usuario."
}
],
"lastModified": "2026-06-17T02:06:02.827",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:storcenter_px12-450r_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9C681D87-390C-4515-876B-56F301C6C2E8"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:storcenter_px12-450r:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "CDDD583F-99C1-474D-9D33-CB3FFBF87710"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:storcenter_px12-400r_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1552A6C4-D72C-4F4A-959A-A74FB2F9331F"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:storcenter_px12-400r:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "AC5322D3-C5F9-4E1B-9E92-E4199D4D4E38"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:storcenter_px4-300r_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6DC36B80-3542-46E8-ABB0-988BF8405336"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:storcenter_px4-300r:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "74CF0CA3-C011-479E-90DB-1C4D9136778C"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:storcenter_px6-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6C7F667B-CF55-458E-A0DF-2D0BA47FF34E"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:storcenter_px6-300d:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8750825E-AD9D-43FF-BA19-C1DC360E4050"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:storcenter_px4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "57CA96CA-47B7-4C36-B160-49AEAFEC7AE9"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:storcenter_px4-300d:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "30DAD273-0243-4C4B-BA48-98843262D454"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:storcenter_px2-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D9442509-43F9-43AE-ABB8-A109029CBCB8"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:storcenter_px2-300d:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "67148992-00E9-4F99-8027-6AA0C56D64C3"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:storcenter_ix4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0538AFC3-AF46-4A3D-BDA2-3D2B287C5083"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:storcenter_ix4-300d:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "70A8A885-87E4-47B6-964C-BD6B2CC253C3"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:storcenter_ix2_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D076F4B4-CC3B-4FC4-8E65-D2B656FB8F3E"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:storcenter_ix2:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3CF64BC7-7AE0-4822-9F95-325EF6B914CB"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:storcenter_ix2-dl_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "73152B06-114D-41CA-B4A4-F430F7A1D818"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:storcenter_ix2-dl:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7E46920A-82FF-4E15-AB22-DFDB6D532DB2"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:ez_media_\\&_backup_center_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "815AF29A-A455-4452-BEDC-469072A078CF"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:ez_media_\\&_backup_center:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "70B23F2C-23A4-44E1-AD8B-89F3A9E32013"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:px12-450r_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "24151BE4-3D25-4ED6-BD93-117C9AEDEC80"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:px12-450r:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "BDEDB98C-CB83-467A-B866-1E26146977BA"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:px12-400r_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F5FB2FAB-E9C6-48F9-B4B0-5FAF908E9FEF"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:px12-400r:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "068F1733-22CD-4265-8519-54968CBCDA51"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:px4-400r_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5BAE671E-04BF-4BAE-847A-8236FB9EB927"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:px4-400r:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3D8C2AAD-0356-4C4C-B1F2-50736844A809"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:px4-300r_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A7298F84-E758-4AB3-9F0C-6F6B11997E69"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:px4-300r:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "93AECD5C-256C-4F24-8162-14E569CDCED6"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:px6-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "83A7AFAE-89F3-4E69-83C4-77361D5DBD2B"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:px6-300d:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E32EDB44-96C0-425C-B192-0AE8C5BC265A"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:px4-400d_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F95A331F-E040-4025-AD3F-C6118204091D"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:px4-400d:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2441B8E2-C356-49C1-BD7B-028C4A83616C"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:px4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "80271F4B-3195-4A9A-A5B7-9CED966AC29C"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:px4-300d:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "EF9B4663-D9EB-4207-B393-CDF45F020A86"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:px2-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "96FCF0FF-5EF8-4E9E-B22B-ABE34134BF53"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:px2-300d:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "C110122A-D64C-417F-BC56-0F0B34509062"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:ix4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B5B15B3E-FE90-43C1-9724-1FA19D4F0759"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:ix4-300d:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D5C1AB5D-19B0-43F0-9656-3D78ED8047F6"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:ix2_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5471D381-CEEB-4351-B78A-41ECA2656A37"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:ix2:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "9C0F4B2B-B3E1-4456-B57A-7E96BAFC6507"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:ez_media_\\&_backup_center_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "815AF29A-A455-4452-BEDC-469072A078CF"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:ez_media_\\&_backup_center:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "70B23F2C-23A4-44E1-AD8B-89F3A9E32013"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "psirt@lenovo.com"
}