CVSS 3.0
8.8 highCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2018-9082
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the password changing functionality available to authenticated users does not require the user's current password to set a new one. As a result, attackers with access to the user's session tokens can change their password and retain access to the user's account
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
- CWE
- CWE-384
- Published
- Modified
- Record from
- the NVD, synced
Affected
- lenovo:ez_media_\&_backup_center_firmware
- lenovo:ix2_firmware
- lenovo:ix4-300d_firmware
- lenovo:px12-400r_firmware
- lenovo:px12-450r_firmware
- lenovo:px2-300d_firmware
- lenovo:px4-300d_firmware
- lenovo:px4-300r_firmware
- lenovo:px4-400d_firmware
- lenovo:px4-400r_firmware
- lenovo:px6-300d_firmware
- lenovo:storcenter_ix2-dl_firmware
- lenovo:storcenter_ix2_firmware
- lenovo:storcenter_ix4-300d_firmware
- lenovo:storcenter_px12-400r_firmware
- lenovo:storcenter_px12-450r_firmware
- lenovo:storcenter_px2-300d_firmware
- lenovo:storcenter_px4-300d_firmware
- lenovo:storcenter_px4-300r_firmware
- lenovo:storcenter_px6-300d_firmware