PT-2018-18835 · Iomega+1 · Iomega+1

Published 2018-09-28 · Updated 2018-11-20 · CVE-2018-9074

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier

Description The file upload functionality of the Content Explorer application is susceptible to path traversal, allowing users to upload files anywhere on the device's operating system as the root user.

Recommendations For versions 4.1.402.34662 and earlier, consider disabling the file upload functionality of the Content Explorer application until a patch is available to prevent potential exploitation. Restrict access to sensitive areas of the operating system to minimize the risk of unauthorized file uploads.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-9074

Affected Products

Iomega

Lenovoemc Nas

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-9074 · Security Note
• https://support.lenovo.com/us/en/solutions/LEN-24224 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-9074 · Vendor Advisory